Copilot oversharing checklist
16 things to check before and after you switch on Microsoft 365 Copilot, in the order most teams do them. It follows Microsoft's three-part oversharing blueprint: fix oversharing, put guardrails in place, and meet your record-keeping duties. No sign-up.
1 of 3
Find and fix oversharing
Run the data access governance reports
SharePoint admin centre, Reports
List sites shared with “Everyone except external users”, sites with the most sharing links, and labelled files shared widely. Start with the sites that hold HR, finance, legal and customer data.
Ask site owners to review access
SharePoint admin centre, site access reviews
Send the riskiest sites to their owners to confirm who should have access. Owners know which access is still needed; administrators usually don't.
Remove “Everyone” grants that nobody needs
Site permissions
Take “Everyone except external users” and organisation-wide groups out of site groups where they were added for convenience, and fix folders that no longer inherit the site's permissions.
Hide sites that shouldn't surface
Restricted Content Discovery
For sites that must stay open but shouldn't feed Copilot or search (old archives, for example), turn on Restricted Content Discovery while you clean them up.
Lock the most sensitive sites to a group
Restricted Access Control
Limit sites such as HR or M&A to members of a named group, whatever links or grants exist inside them.
Clean up links on sensitive files
Sharing links
Remove Anyone links and company-wide links on sensitive files, and share again with specific people where access is still needed.
Deal with inactive and ownerless sites
Site lifecycle policies
Archive or delete sites nobody uses (Microsoft 365 Archive keeps them retrievable), and give ownerless sites an owner.
2 of 3
Put guardrails in place
Make specific people the default link
SharePoint admin centre, Sharing
Set the default sharing link to specific people, and make Anyone links expire, so new oversharing stops building up.
Label what matters
Purview Information Protection
Publish sensitivity labels, apply default labels to sensitive libraries, and auto-label files that contain the sensitive information types you care about.
Keep Copilot away from your most sensitive labels
Purview DLP
Use a DLP policy for the Microsoft 365 Copilot location to stop Copilot using files with your most sensitive labels.
Start with a scoped pilot
Copilot licences
Give Copilot to a small group first and widen it as each area is cleaned. Restricted SharePoint Search can limit search to an allowed list of sites, but only as a short-term measure.
Watch for new exposure
Data Security Posture Management for AI
Use the oversharing assessments and AI activity reports to see where sensitive data appears in prompts and responses.
3 of 3
Meet your record-keeping duties
Turn on auditing
Purview Audit
Check that unified audit log ingestion is on, so Copilot interactions are recorded. It's sometimes off in older tenants.
Retain Copilot interactions where you must
Purview Data Lifecycle Management
Add retention policies for Copilot prompts and responses where your regulators or record rules require them.
Make sure eDiscovery covers Copilot
Purview eDiscovery
Confirm that searches and holds include Copilot interactions, so legal and HR cases aren't missing them.
Re-check every month
Your governance calendar
Re-run the reports or a Radius scan monthly and send new exposures to the owners who can fix them.
Feature names follow Microsoft's documentation at the time of writing. Some features need SharePoint Advanced Management, which Microsoft includes with Microsoft 365 Copilot licences, or Purview capabilities in Microsoft 365 E5 or add-ons. Check your own licensing.
Not sure where to start?
Book a 30-minute call and tell us what worries you about Microsoft 365: oversharing, an audit, or a Copilot rollout. Or email us and we'll reply within one working day.