Data Protection and Governance for Microsoft 365 and Copilot · Topic 6 of 6
Oversharing and SharePoint Advanced Management
AB-900: find oversharing before Copilot, run SharePoint data access governance reports and use Advanced Management and restricted access control.
- 5 min
- Includes a diagram
- Oversharing is a permissions problem that Copilot makes visible.
- Data access governance reports are in the SharePoint admin center under Reports.
- Snapshot reports show the current state. Activity reports show the last 28 days.
What it is
Oversharing means content is available to more people than needed. Examples are a site open to Everyone except external users, or a sharing link for anyone. Copilot does not break permissions, but it makes oversharing obvious, because it can surface any file a user can reach.
The job is to find overshared content, then narrow access. Microsoft gives several tools for this.
How it works
Tools that help troubleshoot oversharing
| Tool | Where | What it helps with |
|---|---|---|
| Data access governance reports | SharePoint admin center | Find sites with broad permissions or heavy link sharing |
| Data risk assessments in DSPM for AI | Microsoft Purview portal | Check usage ranked SharePoint sites for oversharing and suggest fixes |
| Sensitivity labels and DLP for Copilot | Microsoft Purview portal | Protect labeled content and keep Copilot from summarizing it |
| Restricted access control | SharePoint admin center | Limit a site to members of chosen groups |
| Restricted content discovery | SharePoint admin center | Keep a site out of organization wide search and Copilot answers |
| Site access review | SharePoint admin center | Ask site owners to review who has access |
Run a data access governance report
Data access governance reports are in the SharePoint admin center under Reports > Data access governance. They come in two kinds.
| Kind | Reports | Use |
|---|---|---|
| Snapshot reports | Site permissions across your organization, site permissions for users, sensitivity label applied to files | A picture of the current state. Start here to find the sites with the broadest access |
| Activity reports | Sharing links, Shared with Everyone except external users | Recent oversharing activity over the last 28 days |
To run one, you choose the report, set its options, and then select to create it. When the run finishes, you view or download the results. Snapshot reports show data as of when they ran. Organizations without full SharePoint Advanced Management may have to turn on data collection before activity reports work, and some features then need extra licenses.
After the reports, you act: ask site owners to review access, restrict a site, apply labels, or remove broad groups.
SharePoint Advanced Management
SharePoint Advanced Management is a set of SharePoint features for governing content at scale. It is included with Microsoft 365 Copilot licenses, and can also be bought separately. Core features for this exam:
- Data access governance reports to find overshared sites.
- Site access review, where site owners are asked to confirm who should have access.
- Restricted access control, to limit access to a site to chosen groups.
- Restricted content discovery, to keep chosen sites out of search and Copilot.
- Lifecycle tools such as inactive site policies, and a change history report.
Restricted access control
Restricted access control limits a site to the members of one or more security groups or Microsoft 365 groups. A user outside the group cannot open the site or its files, even with earlier permissions or a shared link. A user must have permission and also be in the group. Copilot and search honor the policy too.
| Restricted access control | Restricted content discovery | |
|---|---|---|
| Blocks opening the site | Yes, for users outside the group | No |
| Hides content from search and Copilot | Yes, for users outside the group | Yes, for everyone |
| Use when | Access should be limited to a group | The site is accessible but should not feed Copilot and search |
A worked example
Before rolling out Copilot, an administrator runs the site permissions report and finds an HR site open to Everyone except external users. She applies restricted access control to the HR security group. A finance site cannot be locked yet because many people need to open files. She uses restricted content discovery so Copilot and search stop surfacing it while owners clean up. She also starts a site access review so owners confirm membership.
How the exam asks about this
- "Which SharePoint admin center report finds sites shared with everyone in the organization?" Data access governance reports.
- "Limit access to a site to members of one security group." Restricted access control.
- "Keep a site out of Copilot answers while access stays unchanged." Restricted content discovery.
What to remember for the exam
- Oversharing is a permissions problem that Copilot makes visible.
- Data access governance reports are in the SharePoint admin center under Reports.
- Snapshot reports show the current state. Activity reports show the last 28 days.
- Restricted access control limits a site to chosen groups. Restricted content discovery hides it from search and Copilot.
- Site access review asks owners to review who has access.
Restricted content discovery does not change permissions. People who already have access can still open the files directly.
Common mistakes
Mixing up the two restricted features. Access control blocks opening the site. Content discovery only removes it from search and Copilot.
Fixing oversharing inside Copilot. Copilot has no switch for it. Fix permissions, labels and discovery.
Thinking the reports change anything. They only report. You still must act on what they find.
Check yourself
Where do you find data access governance reports?
In the SharePoint admin center under Reports, then Data access governance.
What does restricted access control do?
It limits a site and its content to members of the specified groups, and Copilot and search honor it.
Which feature asks site owners to confirm who should have access?
Site access review.
Topic 6 of 6 in Data Protection and Governance for Microsoft 365 and Copilot
Test yourself on Data Protection and Governance for Microsoft 365 and Copilot
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.