CyberThreats.au

Independent cybersecurity education

SearchScammed or hacked?Get help

For you

ScamsIs this a scam?

Types of scams

All scam guides

Practise

Protect yourselfMake my security checklist

Your devices

Everyday situations

Accounts and passwords

Privacy

All protect yourself guides
Cyber threats

Common threats

Newer and specialised threats

All cyber threat guides
Security products

Devices

Accounts and identity

Network and privacy

Backup

All product guides
Free checklists

For you

For work

All free checklists

For work

Small businessSmall business security checklist

Foundations

Payments, suppliers and incidents

All business guides

AI and cloud

All AI and cloud guides
Microsoft 365Microsoft 365 readiness checklist

Identity and access

Email

Teams, SharePoint and OneDrive

Data, devices and admin

All Microsoft 365 guides

Microsoft 365 Copilot and agents

SharePoint oversharing and Copilot, explained

How Microsoft 365 Copilot oversharing relates to existing SharePoint and OneDrive permissions, the signs Microsoft describes, and its governance steps.

Last reviewed
Reading time
7 minutes

Where to start: SharePoint oversharing before Copilot

Copilot uses the access people already have, so the work is mostly in SharePoint. These are the priority actions Microsoft's Copilot governance guidance describes, with where to find them.

  1. Find overshared sites with the data access governance reportsIn the SharePoint admin center, expand Reports and select Data access governance. Reports cover sharing links, 'Everyone except external users' and site permissions; Microsoft lists SharePoint Advanced Management as a prerequisite.Steps for the reports
  2. Check the organisation-wide sharing levelIn the SharePoint admin center, expand Policies and select Sharing. Microsoft's guidance describes disabling or restricting company-wide sharing groups and Anyone links at the tenant level.SharePoint and OneDrive sharing settings
  3. Hide sensitive sites from Copilot while you fix themIn Sites > Active sites, select the site and on the Settings tab turn on 'Restrict content from Microsoft Copilot'. Microsoft says this doesn't change permissions, and needs a Copilot licence with SharePoint Advanced Management.Steps for Restricted Content Discovery
  4. Remove excess access and fix broken inheritanceMicrosoft describes removing excess users, groups and company-wide links, correcting libraries and folders whose permissions differ from their site, and confirming each site has an owner.Microsoft's remediation steps
  5. Add guardrails with labels and DLPMicrosoft describes requiring site sensitivity labels, default and automatic labels for files and email, and Purview DLP for Copilot to exclude sensitive content from Copilot responses.Microsoft's guardrail steps

Based on Microsoft Learn's Copilot governance guidance and its SharePoint pages on data access governance reports, sharing settings and Restricted Content Discovery, checked October 2026. Menus can change; Microsoft's pages have the latest steps.

Key points

  • Microsoft says Copilot uses data that the user already has permission to access, so content that is already overshared can appear in answers.
  • Microsoft's documentation sets out three steps: remediate oversharing, set up guardrails, and meet regulations.
  • Microsoft says Restricted Content Discovery doesn't remove content from the search index, and people who already have access can still open the content directly.
  • The OAIC states that privacy obligations apply to personal information input into an AI system, and to the output data.

Microsoft 365 Copilot can summarise documents, answer questions and draft content using an organisation’s own files, email and chats. Microsoft’s documentation says Copilot does this “using data that the user already has permission to access”, so content that is already overshared in SharePoint or OneDrive can appear in its answers. Microsoft also states that when an organisation’s data is well governed, current and appropriately shared, Copilot can deliver accurate, relevant and secure responses. That makes existing permissions an important part of any Copilot rollout. This page explains how Microsoft 365 Copilot oversharing relates to existing SharePoint and OneDrive permissions, the signs Microsoft describes, and the three steps in Microsoft’s governance guidance.

Why oversharing matters with Copilot

In many organisations, some content is shared more widely than intended: a site open to a company-wide group, a folder whose permissions differ from its site, or a file shared with a link anyone can use. When finding a file means knowing where it is and browsing to it, content like that can go unnoticed.

An AI assistant that searches across everything a user can access changes that. Copilot doesn’t grant new access, according to Microsoft’s description, but it uses the access the user already has. Content that is overshared can therefore appear in an answer.

Signs of oversharing Microsoft describes

Microsoft’s guidance describes using Microsoft Purview and SharePoint Advanced Management (SAM) to find sites and files that are “overshared, ownerless, inactive, or contain sensitive data that could be surfaced by Copilot”. It refers to a SAM assessment that identifies:

  • sites with oversized audiences
  • use of “Everyone except external users” (which Microsoft abbreviates EEEU) and other company-wide sharing groups
  • broken permission inheritance, where a library or folder has different permissions from its site
  • inappropriate sharing
  • sites that are inactive or ownerless.

Microsoft’s SharePoint sharing documentation explains that Anyone links, where enabled, “provide anonymous access to anyone who has the link, including people outside your organization.” SharePoint and OneDrive sharing settings explains the organisation-level sharing levels, Anyone links and permission inheritance.

How to find and limit overshared sites

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s pages on data access governance reports and Restricted Content Discovery have the latest steps.

To see the reports, sign in to the SharePoint admin center as a SharePoint Administrator, expand Reports and select Data access governance. Microsoft lists snapshot reports (such as Site permissions across your organization) and activity reports (Sharing links and Shared with ‘Everyone except external users’). Microsoft’s page points to the SharePoint Advanced Management prerequisites for licensing, and notes that organisations with Microsoft 365 E5 alone get a reduced version without snapshot reports.

To restrict a site from Copilot while it’s being fixed:

  1. In the SharePoint admin center, expand Sites and select Active sites.
  2. Select the site and open the Settings tab.
  3. Turn on Restrict content from Microsoft Copilot, then select Save.

Microsoft says Restricted Content Discovery “doesn’t change existing permissions”, so people with access can still open the content directly, and that it needs a Microsoft Copilot licence with SharePoint Advanced Management available.

The approach in Microsoft’s documentation

Microsoft’s guidance follows three steps.

1. Remediate oversharing

Microsoft’s documentation describes:

  • reviewing Microsoft Purview Data Security Posture Management (DSPM) data risk assessments to identify overshared sites with sensitive data, risky sharing links and frequently accessed content
  • turning on SAM Restricted Content Discovery to exclude sensitive sites from Copilot discovery as an interim protection
  • removing excess users, groups and company-wide sharing links, and rescoping sharing links to approved users or groups
  • correcting broken permission inheritance on libraries and folders
  • starting SAM site access reviews for high-risk sites so site owners can manage access, down to the file level
  • assigning or confirming site ownership, and applying site sensitivity labels.

2. Set up guardrails

Microsoft’s documentation describes:

  • disabling or restricting company-wide sharing groups and Anyone links at the tenant level
  • enforcing Restricted Access Control (RAC) by default for business-critical sites when they are created
  • requiring site sensitivity labels when sites are created, and configuring default and automatic sensitivity labels for files and email
  • configuring Microsoft Purview data loss prevention (DLP) for Copilot to exclude sensitive content from Copilot grounding, and a DLP policy that restricts Copilot from responding to prompts containing specified sensitive information. How sensitivity labels and data loss prevention differ explains both features.

3. Meet regulations

Microsoft’s documentation describes:

  • using DSPM Activity Explorer to review Copilot interactions (prompts and responses), web search keywords and sensitive data activity
  • deciding how long to keep audit logs, and how to keep or delete Copilot interactions, based on legal and regulatory requirements (see how the Microsoft 365 audit log works)
  • identifying and addressing inactive or obsolete sites, and using Microsoft 365 Archive to store inactive but high-value content “while preventing Copilot from processing or reasoning over it”
  • applying Purview retention and deletion policies to remove inactive or obsolete files, which Microsoft says improves the quality of Copilot responses.

Privacy obligations

Australia’s privacy regulator, the Office of the Australian Information Commissioner (OAIC), states that privacy obligations “will apply to any personal information input into an AI system, as well as the output data generated by AI” where it contains personal information. The OAIC’s guidance describes a “privacy by design” approach that includes conducting a privacy impact assessment, and, as a matter of best practice, recommends that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools. Whether and how the Privacy Act applies depends on the organisation; the OAIC’s guidance is the official reference, and this page isn’t legal advice.

Common questions

Can Microsoft 365 Copilot show people files they shouldn’t see?

It can show files that are already overshared. Microsoft says Copilot works “using data that the user already has permission to access”, so it doesn’t grant new access, but a site open to a company-wide group or a file shared with an Anyone link can surface in an answer for anyone who already has that access. Why oversharing matters with Copilot explains how this happens.

How do I find overshared SharePoint sites before a Copilot rollout?

Microsoft describes the data access governance reports in the SharePoint admin center, under Reports > Data access governance. They include site permissions across the organisation, sharing links, and content shared with “Everyone except external users”. Microsoft lists SharePoint Advanced Management as a prerequisite and notes that Microsoft 365 E5 alone gets a reduced version. How to find and limit overshared sites has the steps.

How do I stop Copilot using a SharePoint site?

Microsoft describes Restricted Content Discovery as an interim protection. In the SharePoint admin center, select the site under Sites > Active sites, open the Settings tab, turn on Restrict content from Microsoft Copilot and save. Microsoft says this needs a Microsoft Copilot licence with SharePoint Advanced Management available. How to find and limit overshared sites sets out the steps and what the setting doesn’t change.

Does Restricted Content Discovery remove access to a site?

No. Microsoft says Restricted Content Discovery “doesn’t change existing permissions”, so people with access can still open the content directly, and that it doesn’t remove content from the search index. Microsoft’s guidance pairs it with removing excess users, groups and company-wide sharing links and correcting broken permission inheritance. 1. Remediate oversharing lists the steps Microsoft describes for fixing the underlying access.

Is SharePoint Advanced Management included with Copilot?

Microsoft’s Copilot governance documentation states that SharePoint Advanced Management is included with Copilot licences, and that foundational Microsoft Purview capabilities are included in Microsoft 365 E3, with some optimised features in Microsoft 365 E5 or E7. Microsoft’s licensing changes often, so its current documentation or a licensing provider is the place to confirm it. The approach in Microsoft’s documentation shows where each tool is used.

Do Australian privacy obligations apply to information used with Copilot?

The OAIC states that privacy obligations “will apply to any personal information input into an AI system, as well as the output data generated by AI” where it contains personal information. The OAIC’s guidance describes a privacy by design approach, including a privacy impact assessment. Whether the Privacy Act applies depends on the organisation, and this page isn’t legal advice. Privacy obligations has the OAIC’s wording.

Sources

CopilotSharePointOneDriveoversharingpermissionsMicrosoft Purviewdata protection