Skip to content

Find the overshared sites before Copilot does

Control
CR01
Kit
Copilot readiness
Area
Find and fix oversharing
Priority
Highest
Effort
2 h
Last reviewed

Licence and role

Data access governance reports and EEEU insights are part of SharePoint Advanced Management, which Microsoft includes with Microsoft 365 Copilot licences. DSPM data risk assessments need Microsoft Purview (check your plan). SharePoint Administrator role.

Why it matters

Copilot answers from everything a user can open. Sites shared with 'Everyone except external users', broken inheritance and old company-wide links are the usual source of 'how did Copilot find the salary sheet'. Microsoft's blueprint starts here: identify high-risk sites and content first.

Steps

  1. SharePoint admin center > Reports > Data access governance: run the permission state report for SharePoint sites and the 'Everyone except external users' (EEEU) insights. Export both.
  2. If you have Microsoft Purview DSPM: run the data risk assessment for oversharing (overshared sites with sensitive data, risky sharing links, frequently accessed content).
  3. Sort by sensitivity (HR, finance, legal, board, M&A first) and by audience size. Put the top 20 sites in the tracker with a named owner each.
  4. Run the read-only check below to list sites that allow sharing with anyone or with guests, and add the sensitive ones to the same list.

Impact on users

None. Reports and the check only read data. Report generation can take hours on large tenants.

Rollback

Nothing to roll back.

Read-only check

Reads settings only. It changes nothing in your tenant or on the device.

Modules, connection and role 
Requires: Microsoft.Online.SharePoint.PowerShell (SharePoint settings), ExchangeOnlineManagement (audit).
Connect first:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Connect-ExchangeOnline
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). CR05 will move to the Graph AuditLogQuery API before then.

$s = Get-SPOSite -Limit All | Where-Object { $_.SharingCapability -ne 'Disabled' }
"Sites with external sharing on: $($s.Count)"
$s | Group-Object SharingCapability | ForEach-Object { "$($_.Name): $($_.Count)" }
$s | Where-Object { $_.SharingCapability -eq 'ExternalUserAndGuestSharing' } | Select-Object -First 50 | ForEach-Object { "Anyone links allowed: $($_.Url)" }

How to verify

A list of high-risk sites with an owner for each exists in the tracker, and the DAG/EEEU reports are saved with the date they were run.

Sources

This control is in the M365 Copilot Readiness Kit

The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 24 controls.

Download the free Top 5 See the kit