Copilot readiness: oversharing clean-up checklist

Before you start

Copilot grounds its answers in Microsoft Graph and the semantic index, and both are trimmed to what the user can access.

• "Everyone except external users" (or "Everyone") granted on a site, library, folder or file.
• Public teams and Microsoft 365 groups, whose content everyone in the organization can open.
• Organization-wide and Anyone sharing links, which work for whoever receives or is forwarded the link.
• Old sites with broken inheritance, stale direct permissions and no active owner.

Checklist

1. 1

   Find oversharing with data access governance reports

   In the SharePoint admin center, open Reports › Data access governance.

   • Start with the snapshot report Site permissions across your organization, Microsoft's recommended baseline. It highlights the sites with the broadest access: large audiences, guests and "Everyone except external users". Run it quarterly.
   • Add the activity reports, which cover the last 28 days: Sharing links (Anyone, People in your organization and Specific people links) and Shared with 'Everyone except external users'.
   • If you use the activity reports without SAM, you must turn on data collection first. Reports appear 24 hours later and hold 28 days of data, so do it early.
   • The Site permissions for users snapshot report lists every site a chosen user can reach; run it for pilot users to see what Copilot could draw on.
   • The Sites and files shared via special SharePoint groups snapshot report lists every site, folder and file in SharePoint and OneDrive that "Everyone except external users" or "Everyone" can reach. Run it from View reports in that section; you can rerun it every 30 days.
2. 2

   Contain the riskiest sites

   Restricted Content Discovery (RCD) takes a site's content out of Copilot and organization-wide search for people who don't own it and haven't recently worked with it. For a batch:

   powershell

   Connect-SPOService -Url "https://contoso-admin.sharepoint.com"
   
   # rcd-sites.csv has a Url column
   Import-Csv .\rcd-sites.csv | ForEach-Object {
       Set-SPOSite -Identity $_.Url -RestrictContentOrgWideSearch $true
   }
   
   # Stop new "Everyone except external users" grants from the people picker
   Set-SPOTenant -ShowEveryoneExceptExternalUsersClaim $false

3. 3

   Fix permissions with site owners

   Except for the special-groups report, whose item list you can script against, these reports stop at site level for compliance reasons, and site owners know what should be shared. From a data access governance report, select up to 100 sites and start a site access review.

   • Remove "Everyone except external users" from SharePoint groups and items.
   • Delete organization-wide and Anyone links, or replace them with Specific people links.
   • Make public teams private when their content isn't meant for everyone.
   • Give ownerless sites an owner, and archive or delete inactive ones.
4. 4

   Protect sensitive content with labels and DLP

   Permissions drift, so sensitive content needs protection of its own. With Microsoft Purview sensitivity labels that apply encryption, Copilot uses a file only for users who have the VIEW and EXTRACT usage rights.

5. 5

   Run it as a phased rollout

   Phase	Copilot scope	Oversharing work
   Pilot	A small group	Baseline report, RCD on the most sensitive sites, clean-up of the top-ranked sites
   Deploy	Wider waves	Site access reviews in batches, Specific people as the default link, labels on sensitive sites
   Operate	Everyone licensed	Snapshot report every quarter, activity reports monthly, RCD removed as sites are fixed

Verify

• Compare snapshot reports between runs: the number of broadly accessible sites should fall.
• Check RCD with Get-SPOSite -Identity <url> | Select-Object Url, RestrictContentOrgWideSearch (good looks like True); the site also shows a Restricted tag and no Copilot button.
• Sign in as a test user who has access to an RCD site but has never opened a particular document there. Ask Copilot about it: it shouldn't cite that document, and organization-wide search shouldn't return it. Allow time for large sites to propagate.
• Track site access reviews to completion, then rerun the report to confirm the findings are gone.

Tips & gotchas

• RCD is not a security boundary. Anyone with permissions can still open the files directly, so it buys time; it doesn't fix access.
• RCD also hides content from people who should see it in Copilot and removes the site's AI features for its own members, so treat it as temporary.
• Don't wait for perfection. Fix the sites with broad access and sensitive content first, and start the pilot in parallel.
• Agents follow the same rules. Agents grounded in SharePoint see what their users can see, so this clean-up protects them too.
• Cover OneDrive separately. Site access reviews and RCD skip OneDrive, so use the sharing links and special-groups reports, which cover it.