Guides › Copilot oversharing

Microsoft 365 Copilot Oversharing: How to Find and Fix Permission Exposure Before Rollout

Hunter Moore, Founder and CTO · Updated October 18, 2026

Microsoft 365 Copilot oversharing is what happens when Copilot answers a question from files the user was never meant to see, because the user's identity could already open them. Copilot enforces existing permissions and bypasses nothing. The exposure comes from permissions that grant more than anyone intended, which in most tenants means years of sites, sharing links and group memberships that nobody reviewed because nobody could find them. This page explains why the problem appears at rollout, how to measure it with Microsoft's own tooling, which controls narrow it and which only hide it, and how to keep it closed once Copilot is live.

The short version

Copilot is not the leak. It reads what the user's identity can read, across SharePoint, OneDrive, Teams and Exchange, and joins it in one answer. The permissions underneath are the leak.
Measure before you enable. SharePoint Advanced Management's data access governance reports show sites open to Everyone except external users, sharing-link activity and label coverage. Sample real identities and count what each can open.
Hide, then fix. Restricted Content Discovery keeps a site out of Copilot and org-wide search while permissions are repaired; it changes discoverability, not access. Restricted SharePoint Search can no longer be newly enabled.
Keep it closed. Purview audit records which resources Copilot touched per interaction. Pair that with a recurring oversharing report and a refusal test before each expansion.

Why Copilot surfaces files people should not see

Microsoft's architecture documentation states that Copilot “can only summarize or reference content that the user is authorized to access.” That sentence is accurate and it is the whole problem. Before Copilot, a finance share with read access for every employee was safe in practice because no one outside finance knew it existed, had the link or had a reason to search for it. Discovery was the control. Copilot searches the tenant's semantic index on every prompt under the user's identity, so anything the identity is technically authorized to open becomes an answer. The data silos guide describes this as silo friction, a control nobody designed that held for twenty years and that an assistant removes in a configuration screen.

Four shapes account for most of what an oversharing audit finds. Sites and libraries granted to Everyone except external users, often by a site owner in 2018 who wanted to stop fielding access requests. Sharing links scoped to anyone in the organization, created one document at a time and never expired. Group memberships inherited through reorganizations, so that a team's site is readable by a parent group that has since tripled in size. And content that moved without its permissions being reconsidered: a departed employee's OneDrive reassigned to a manager, a Teams channel whose files tab was shared with a guest group, a migration from a file server that flattened inheritance. None of these were incidents. Each one was a reasonable decision at the time that Copilot now acts on at scale.

How to measure it before anyone turns Copilot on

SharePoint Advanced Management ships the reports that make the problem countable, and Microsoft's own guidance is to run them before a Copilot deployment. The permission state report gives a snapshot of how broadly content is exposed across every SharePoint and OneDrive site. The Everyone except external users insights report lists the items and groups shared that way in the last 28 days and the policies applied to those sites. The sharing links activity report ranks sites by new links created, the sensitivity label snapshot shows where labels are and are not applied, and the site permissions report for a given user lists every site that user can reach and how the access was granted. Site access reviews hand the findings to site owners with a deadline. The reports run from the SharePoint admin center or PowerShell, and Microsoft notes that SAM capabilities are the preparation step for Copilot and agents.

Reports describe the tenant; the second measurement describes Copilot. Pick five to ten real identities across roles, including a new hire and a contractor, and enumerate what each can open in the sites you intend to expose. Then run Copilot itself under each identity against a short list of questions it should not be able to answer: the bonus plan, the pending acquisition, the customer with the open dispute, the HR case. Count the documents it cites. The leakage self-test gives the full procedure and a way to express the result as a rate. That rate is the deployment's day-one exposure, and it is the number to report upward, because it is the only one a non-technical reader can act on.

The controls, and what each one actually does

Microsoft offers several controls with similar names and different effects. The distinction that matters is whether a control changes who can open a document, or only whether Copilot and search will surface it. The table sorts them.

Control	What it changes	What it leaves	Notes from Microsoft's documentation
Permission remediation (remove EEEU grants, expire links, restore inheritance)	Who can open the document	Nothing; this is the fix	Data access governance reports and site access reviews in SharePoint Advanced Management find the targets and delegate the work to site owners.
Restricted access control	Who can open a site, limited to specified groups	Content inside the group's reach	A permission change at site level; useful for sites whose audience is known and whose item-level permissions are a mess.
Restricted Content Discovery	Whether a site's content appears in Copilot responses and org-wide search	Direct access for anyone who already has it; the content stays in the index	Per site, SharePoint only, requires Copilot licence with SAM; described as a temporary governance control. Updates on sites over 500,000 items can take more than a week.
Restricted SharePoint Search	Allow-list of up to 100 sites visible to Copilot and org-wide search	Everything inside the allowed sites; everything outside stays invisible to Copilot	Not a security boundary per Microsoft; closed to new enablement from July 31, 2026.
Sensitivity labels with Purview DLP	Whether Copilot will process items carrying specified labels	Unlabeled content; items may still appear in citations	DLP policies scoped to the Microsoft 365 Copilot location can prevent processing of labeled files and emails. Depends entirely on label coverage.
Purview audit of Copilot interactions	Nothing; it records	The entitlement question (was this user meant to see it)	Records accessed resources with sensitivity label IDs, host app, agent and model provider per interaction. Retention follows your audit retention policies.

Two controls that get confused

Restricted SharePoint Search was the first stopgap: an allow-list of sites that Copilot and organization-wide search could see, capped at 100 sites, which Microsoft describes as not a security boundary. From July 31, 2026 it can no longer be newly enabled, and tenants are pointed to Restricted Content Discovery and SharePoint Advanced Management instead. A stopgap with a 100-site cap existed because the number of over-shared sites in a typical tenant is larger than 100, which is a useful thing to know about your own tenant before you start.

Restricted Content Discovery is the replacement and works the other way around: a deny-list applied per site that keeps the site's content out of Copilot responses and organization-wide search, and removes the Copilot entry points from the site itself. Microsoft is precise about its limits. It affects discoverability, not permissions, so anyone who could open a file can still open it. It does not remove content from the search index, it is not supported for OneDrive, it requires a Copilot license with SharePoint Advanced Management, and on sites with more than 500,000 items an update can take more than a week to apply. Microsoft calls it a temporary governance control that buys time to right-size access. Used that way, it is the right first move. Used as the permanent answer, it leaves the permission problem exactly where it was and hides the sites Copilot would have been most useful for.

A sequence that holds

The order below reflects what remediation projects in mid-size tenants actually look like: a few days of reporting, weeks of permission work that should not block the pilot, and a measurement loop that outlives the project. The connection procedure covers the same eight steps for every assistant; this is the Copilot-specific reading.

Run the data access governance reports.Permission state, Everyone except external users, sharing links, sensitivity label snapshot. Export them; this is the baseline.
Rank sites by exposure and sensitivity.EEEU grants on sites holding HR, finance, legal, M&A or customer data go first. The data classes in your AI policy decide the order.
Apply Restricted Content Discovery to the top of the list.Buy time for the sites that matter most. Record the date and the exit criterion for each one.
Fix permissions, starting with EEEU and organization-wide links.Site access reviews put the decision with the owner. Restricted access control handles sites whose audience is known.
Label and write the DLP policy.Labels on regulated content, then a Copilot-location DLP policy that stops processing of the highest labels. Check the label snapshot report; unlabeled is uncovered.
Pilot with a bounded group and real identities.Run the refusal test under five to ten identities before the pilot and again before each expansion.
Turn on and read the audit.Purview records which resources each interaction touched. Review the sensitivity label IDs weekly in the first month.
Schedule the reports.Monthly EEEU and sharing-link reports, quarterly access reviews. Oversharing is a rate, not a one-time cleanup.

What the Microsoft controls leave open

Three things remain after every control in the table is in place. The first is the gap between authorized and intended, which no setting closes, because only a person who knows what a site is for can say who should read it; the reports find the sites, and owners still have to decide. The second is evidence at the level an auditor asks for. Purview's Copilot interaction records include the resources Copilot accessed for each response with their sensitivity label IDs, the hosting app, the agent and the model provider, which is more than most platforms offer. What they do not do is compare each retrieval against what the user was meant to see, so the entitlement question still has to be answered by a test, not a log. The third is everything that reaches a model outside the Microsoft 365 service boundary: Anthropic models offered inside Copilot are excluded from the EU Data Boundary and in-country processing commitments, Copilot Studio agents carry their own privacy terms, and a user who pastes a Copilot answer into a personal ChatGPT account has left the tenant entirely. The Copilot security review checklist turns these into questions for the approval meeting.

Where Hardshell sits

Hardshell measures and governs the part of this problem that the tenant controls cannot. Before rollout it tests what an assistant can be made to disclose under real identities and maps each finding to MITRE ATLAS technique IDs, which gives the exposure a number before the first user sees it. For data connected to Copilot, ChatGPT, Claude, Gemini or an internal assistant, it enforces each user's existing permissions at query time without migrating the data, substitutes stand-ins for real identifiers before content reaches a third-party model, and records every retrieval under opaque IDs so the entitlement question has a log to answer it. It deploys as a cloud service, in a private cloud, or as an offline bundle.

Frequently asked questions

Does Microsoft 365 Copilot respect SharePoint permissions?

Yes. Microsoft states that Copilot can only summarize or reference content the user is authorized to access, and that holds. Oversharing is what those permissions already allowed; Copilot makes it discoverable on every query.

Is Restricted SharePoint Search still available?

Not for new enablement. Microsoft capped it at 100 sites, describes it as not a security boundary, and closed it to new enablement from July 31, 2026, directing tenants to Restricted Content Discovery and SharePoint Advanced Management.

Does Restricted Content Discovery remove a site's content from the index?

No. Microsoft states that it affects discoverability rather than access permissions, does not remove content from the Microsoft 365 search index, and does not apply to OneDrive. Users who have access keep it. It is a temporary control for use while permissions are fixed.

Can sensitivity labels stop Copilot from using a document?

Labels on their own travel with the content and are inherited by Copilot outputs. A Purview DLP policy scoped to the Microsoft 365 Copilot location can prevent Copilot from processing items that carry specified labels, which blocks grounding on their content; Microsoft notes the item can still appear in citations. Coverage is only as good as label coverage, which the sensitivity label snapshot report shows.

How long does Copilot oversharing remediation take?

Running the reports takes days. Fixing what they find typically takes weeks in a tenant with a decade of SharePoint history, which is why the pilot scope should be small enough to start before remediation finishes everywhere, with Restricted Content Discovery covering the sites still in review.

What should we test before enabling Copilot for everyone?

Under a sample of real identities, ask Copilot a set of questions it should refuse and count the documents it cites. Repeat before each expansion of the user group or the connected sources, and keep the number with the deployment record.

Sources (accessed October 2026)

Microsoft Learn, Microsoft 365 Copilot architecture: data protection and auditing; Restricted SharePoint Search; Restrict discovery of SharePoint sites and content (updated 11 October 2026); SharePoint Advanced Management overview; Get ready for Copilot with SharePoint Advanced Management; Audit Copilot and AI applications in Microsoft Purview (updated 26 August 2026); Enterprise data protection in Microsoft Copilot.