r/sharepoint • u/Harvey-Lane-251 • Aug 10 '26
SharePoint Online Microsoft Copilot found a decade of our oversharing in about a week.
we ran a pilot group expecting complaints about accuracy when we turned on copilot, but it turned into the most effective permissions auditor we've ever run, and entirely by accident at that.
what happened was someone asked it something totally normal about budgets and it pulled numbers from a finance folder that had been shared to "everyome in the org" during a reorganisation. this means that if your account can reach a file, copilot will read it, summarise and quote it back in the chat. I imagine this would translate to it auditing ten years of our sharepoint sharing.
If you made it past the pilot stage, how did you get through cleaning up the oversharing and did you find a way to see what people are feeding the non copilot AI tools?
23
u/uberboot Aug 10 '26
With the activation of Copilot in your tenant, you also gain access to SharePoint Advanced Management across the whole organization at no additional costs.
In here (you can access these reports from the admin portal) you can run data oversharing reports, build inactive site policies, and also trigger site owner permission review processes.
2
u/BillSull73 Aug 10 '26
doesnt this just show the last 30 days or so? I need lifetime
4
u/uberboot Aug 10 '26
The EEEU report only shows recent activity. But the Site permission baseline report shows all permission levels across all sites in scope, including the quantity of Anyone and EEEU links on a site. https://learn.microsoft.com/en-us/sharepoint/data-access-governance-site-permissions-report
From there the Site access review process can help site owners review these permissions and remediate. Or you can slap Restricted Content Discovery on the sites and keep them from showing up in Copilot until the permissions are remediated.
4
u/my1stname Aug 10 '26
I built a PowerShell that audits all SharePoint sites looking for those that are broadly shared. It also spins through individual OneDrives to inventory individual objects that are shared anonymously or with the entire org. Depending on the size of your SharePoint estate you might be able to do that manually. Sharing Hygiene is a real thing that has been a real problem for a long time. Copilot just shines the light of day on it.
1
u/Harvey-Lane-251 Aug 12 '26
Onedrive sweep worries me more. The built in reports everyone's pointing at are sharepoint-site focused, access review flow doesnt even cover onedrive, so personal drives are where the org-wide shares quietly rot. Did your script pull those cleaner than the admin reports?
1
u/my1stname Aug 12 '26
Yeah. As part of the process we set up an app registration so I can get to the details of all the objects in the personal OneDrive sites -- for just that reason. It gives the admin team a chance to see both who is sharing objects org wide or anonymously, and if so included the ability to see object names so they can sniff out docs that shouldn't be shared such.
OneDrive sharing links are a bit of an odd duck when it comes to Copilot. If I have shared a Word doc with an org wide link it isn't available to the entire org, only those in the org who have clicked on the link and thus "redeemed" that token. Its not something people talk about, but it changes the temperature of how much we should care.
If you are in the US I can see if we can get the sales team to initiate a "pre-sales" call. You wouldn't need to buy anything, it would be a chance for us to describe how we do Copilot roll outs. If we talk and you decide that would be helpful, great. If we talk and you decide you're going to go it on your own, also great. :)
3
u/jlboygenius Aug 11 '26
How is this different from the normal sharepoint search? I suppose that the AI may have pulled up something you weren't specifically searching for, but the regular search would have found it too.
This seems more like, AI makes it easier to exploit existing security holes.
There are plenty of tools that would have helped with this in the past, but now the problems are easy to see and you need to deal with it.
1
2
u/mnemosis Aug 11 '26
it's hilarious watching all these companies finally getting the bill for decades of data security neglect. some good 3rd party tools mentioned here but I will also mention Varonis which has overpermission reporting as well as automated remediation. have fun!
1
u/ShareGate_Shaylyn Aug 10 '26
Funny enough, this is pretty much the exact scenario we use when explaining to people why we built ShareGate Protect. What it does is proactively surface oversharing through a tenant-wide view of your SharePoint, Teams, Groups, and OneDrive, so you can see what's exposed and take action on it directly, rather than waiting for Copilot to accidentally surface it for you.
The non-Copilot AI tools question is more of a DLP conversation. What we'd say is that cleaning up what's accessible in your tenant first limits the damage, even if you can't control what gets pasted into external AI tools
1
u/kagato87 Aug 12 '26
I hate to break it to you, but a proper security audit likely would have surfaced that in a few hours and proper controls may have been able to prevent it completely.
Don't fall into complacency. It absolutely will miss things, and it will confidently tell you that everything is perfect because of its sycoohantic nature.
The fact that it found something that big means you need a much deeper audit.
1
u/EnvisionIT_Tips Aug 13 '26
That's right, Copilot can turn into the best permissions auditor at the worst time... kind of like finding out your basement leaks because of a flood. In our experience, permission mapping is typically overlooked when customers start Copilot pilots, and then they surface things they don't want shared with everyone.
We started analyzing open sharing, oversharing, and other risks in projects with PowerShell scripts and Power BI reports. We've since formalized that into a graphical analysis tool that helps our clients and partners see what's overshared at a glance through Power BI reports and allows them to drill down and fix the issues.
Typically, we see things like organization-wide sharing for files that really should only have been shared with a select group of people, or whole sites that are open to everyone that should be locked down. Tools like this can help you find what's overshared. A good next step would be to start using Purview Information Protection so that you can apply sensitivity labels to content and prevent Copilot from using sensitive data in the first place.
1
u/Master_Baby_2700 Aug 28 '26
I’d avoid treating this as a project to clean up every bad SharePoint permission. You’ll probably never finish.
I’d prioritize the intersections of sensitive data + excessive access first. Finding an org-wide shared lunch menu is irrelevant; finding payroll, customer data or credentials with the same permissions is what matters.
Ideally you classify the sensitive data first, map who can actually reach it across SharePoint/OneDrive, and remediate based on risk rather than just how broad the sharing setting looks.
The second part of your question is where this gets interesting. For non-Copilot AI you need visibility at the browser/network layer too, but I’d want that tied back to the same data classification. Knowing someone pasted something into ChatGPT is useful; knowing they pasted something your organization already classified as sensitive is much more actionable.
DSPM + Purview/browser DLP is probably the direction I’d look rather than trying to solve both problems with one control.
1
u/Andriy_Eric-606 Sep 01 '26
most non copilot AI usage shows up as oauth grants in your tenant, someone authorising an ai notetaker or summariser to read their mailbox or files. You can pull a good inventory of what has been connected from there which catches what personal accounts and unmanaged devices hide from the browser tooling. We use Abnormal on that side, it shows whats connected rather than what got pasted so it slots in next to the DLP piece.
1
u/TallWhile9454 1d ago
The budget question is the part that gets me. Nobody was digging around for finance files, but they surfaced anyway.
I work at Opsin, so this is close to what we do. Have you gotten anywhere with the non-Copilot side since posting? Curious whether you’re mostly dealing with people pasting data into chats or tools connected to their mail and files.
1
u/TKCoog075 Aug 10 '26
Look into sharegate protect. It can help you identify areas where you’re over sharing.
1
u/michalorchestry Aug 10 '26
Check out Orchestry as they have a dashboard that shows you not only what is overshared but then you can also attach policies to clean it up at scale. Either do it yourself as an admin or contact content owners so they can do it.
But the policies are important. No point doing this one time or having to wait 28 days to create another report like SharePoint Advanced Management makes you do.
Broken inheritance, sharing links, EEEU links all that stuff is handled :)
25
u/shirpars Aug 10 '26
I believe search functions the same way