Commands › SharePoint Online

Start-SPODataAccessGovernanceInsight

SharePoint Online Microsoft.Online.SharePoint.PowerShell Start-*

This cmdlet generates Data Access Governance (DAG) reports meant to provide insights into potential oversharing of sensitive data in SharePoint and/or OneDrive for Business. SharePoint Advanced Management (SAM) license is required to run these reports.

Quick start script

# Start-SPODataAccessGovernanceInsight — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-SPOService -Url https://$org-admin.sharepoint.com

# 2. Run and inspect
Start-SPODataAccessGovernanceInsight -CountOfUsersMoreThan <Int32> -FileSensitivityLabelGUID <Guid> -Name <String> | Format-List

# 3. Export for evidence / drift tracking
Start-SPODataAccessGovernanceInsight | Export-Clixml .\SPODataAccessGovernanceInsight-$(Get-Date -Format yyyyMMdd).xml

Syntax — 6 parameter sets

EEEUParameterSet

Start-SPODataAccessGovernanceInsight -ReportEntity <ReportEntityEnum> -Workload <WorkloadEnum>
 -ReportType <ReportTypeEnum> -Name <String>
 [-Template <System.Collections.Generic.List`1[Microsoft.Online.SharePoint.TenantAdministration.TemplateEnum]>]
 [-Privacy <PrivacyEnum>] [-SiteSensitivityLabelGUID <System.Collections.Generic.List`1[System.Guid]>]
 [<CommonParameters>]

SharingLinkParameterSet

Start-SPODataAccessGovernanceInsight -ReportEntity <ReportEntityEnum> -Workload <WorkloadEnum>
 -ReportType <ReportTypeEnum> [<CommonParameters>]

LabelParameterSet

Start-SPODataAccessGovernanceInsight -ReportEntity <ReportEntityEnum> -Workload <WorkloadEnum>
 -ReportType <ReportTypeEnum> [-FileSensitivityLabelName <String>] -FileSensitivityLabelGUID <Guid>
 [<CommonParameters>]

SitePermissionsParameterSet

Start-SPODataAccessGovernanceInsight -ReportEntity <ReportEntityEnum> -Workload <WorkloadEnum>
 -ReportType <ReportTypeEnum> -Name <String>
 [-Template <System.Collections.Generic.List`1[Microsoft.Online.SharePoint.TenantAdministration.TemplateEnum]>]
 [-Privacy <PrivacyEnum>] [-SiteSensitivityLabelGUID <System.Collections.Generic.List`1[System.Guid]>]
 -CountOfUsersMoreThan <Int32> [<CommonParameters>]

2 more parameter sets — see the parameter table below.

Parameters (11)

Parameter	Type	Required	What it controls
-CountOfUsersMoreThan	Int32	yes	Specifies the threshold of oversharing as defined by the number of users that can access the site. The number of users that can access the site are determined by expanding all users, groups across all permissions (at...
-FileSensitivityLabelGUID	Guid	yes	Specifies the GUID for the sensitivity label for the file.
-FileSensitivityLabelName	String		Specifies the name of the sensitivity label for the file.
-Name	String	yes	Specifies the name to be given to the generated report.
-Privacy	PrivacyEnum		Specifies the privacy setting of the Microsoft 365 group. Relevant in case of filtering the report for group connected sites.
-ReportEntity	ReportEntityEnum	yes	Specifies the entity that could cause oversharing and hence tracked by these reports.
-ReportType	ReportTypeEnum	yes	Specifies the time period of data based on which DAG report is generated. A 'Snapshot' report will have the latest data as of the report generation time. A 'RecentActivity' report will be based on data in the last 28 days.
-SiteSensitivityLabelGUID	Guid]		Specifies the GUID of the sensitivity label applied to the site.
-Template	TemplateEnum]		Specifies the template of the site. Relevant in case a report should be generated for that particular template.
-UserPrincipalNames	String]	yes	Specifies the user principal names of the users for whom permissions report should be generated.
-Workload	WorkloadEnum	yes	Specifies whether the report is for SharePoint sites or OneDrive accounts.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.