How do you turn SharePoint oversharing reports into a Copilot readiness plan?
Checked October 28, 2026 by Accred Consulting
Run the data access governance reports in the SharePoint admin center, export one as a CSV, and import it into Accred Assess. Assess turns the export into findings for ownerless sites, external sharing and Anyone links, broad or unique permissions, and inactive sites, and records them as evidence in your Copilot readiness assessment. Copilot only shows content a user can already open, so fixing those sites is the real work; Assess tracks it but never changes SharePoint permissions.
Short how-to
- In the SharePoint admin center, run the data access governance reports, such as the sharing links, Everyone except external users, and permission state reports.
- Export the report as a CSV and import it into Accred Assess.
- Work the findings: send site access reviews to the owners of overshared sites, and keep the most sensitive sites out of Copilot with Restricted Content Discovery while their permissions are fixed.
- Run the reports again after the cleanup and import the new export. It replaces the earlier one, so the findings show what is left.
What Accred Assess does with the export
| Finding | What it counts |
|---|---|
| SharePoint sites need accountable owners | Site records that appear ownerless |
| SharePoint external sharing requires review | Anyone-link references and externally shared site records |
| Broad or unique SharePoint permissions require review | Broad-access and unique-permission references |
| Inactive SharePoint sites need lifecycle decisions | Site records that appear inactive |
Accred Assess records each import as observed evidence for the matching controls. It does not mark a control as done; your team records that decision. Assess also reads Copilot policies and sensitivity labels read-only. It is advisory and never changes SharePoint permissions, and view-only members cannot import.
Microsoft facts to know first
- Copilot returns organizational data only when the user has at least view permission to it. For content encrypted with a sensitivity label, the user needs both the VIEW and EXTRACT usage rights.
- Restricted Content Discovery keeps chosen sites out of organization-wide search and Copilot answers, but it does not change permissions. Microsoft calls it a temporary control.
- Restricted SharePoint Search, the older allow list of up to 100 sites, is retiring: new enablement is blocked from July 31, 2026.
- Once one user has a Copilot license, the tenant gets the SharePoint Advanced Management features for Copilot, including these reports, site access reviews, and Restricted Content Discovery. Restricted site creation by apps still needs the Plan 1 add-on, and the sensitivity labels report needs Microsoft 365 E5.
- Microsoft now calls the product Microsoft Copilot; some licenses keep the Microsoft 365 Copilot name during the transition.
The full walk-through
For a step-by-step guide to finding and fixing oversharing, with containment, permission cleanup, and labels, see Accred Consulting’s oversharing guide.
Questions
Can Copilot show users files they could not open before?
No. Copilot only returns organizational content the user already has at least view permission to. The risk is content that is already overshared, which Copilot makes easier to find.
Which SharePoint export does Accred Assess import?
A SharePoint governance CSV export, such as a data access governance report. Assess reads its site records for ownership, activity, sharing, and permissions, and turns down an identical export it has already imported.
Do I need to buy SharePoint Advanced Management for Copilot?
Usually not for oversharing. Once one user has a Copilot license, the tenant gets the data access governance reports, site access reviews, and Restricted Content Discovery. Restricted site creation by apps still needs the SharePoint Advanced Management Plan 1 add-on.
Sources
- Data, privacy, and security for Microsoft Copilot · Microsoft Learn
- Data access governance reports for SharePoint sites · Microsoft Learn
- Restrict discovery of SharePoint sites and content · Microsoft Learn
- Restricted SharePoint Search · Microsoft Learn
- SharePoint Advanced Management features in Microsoft Copilot licenses · Microsoft Learn
- Use Microsoft Purview to manage data security for Microsoft 365 Copilot · Microsoft Learn
Start with the free Accred Assess assessment.
No account or card needed. Results are advisory readiness, not certification.