The mechanism (why this is a SharePoint problem)
Years of 'share with everyone to hit the deadline', org-wide links and 'Everyone except external users' ACLs mean most users can technically open thousands of documents nobody remembers sharing (the permission-model concept's broken-inheritance sprawl). Search made this hard to exploit; Copilot removed the friction — it retrieves under the asker's effective permissions and summarises. The data never moved; the discovery cost collapsed. The fix lives where the sprawl lives: SharePoint.
The toolkit (SharePoint Advanced Management — free with one Copilot seat)
SAM has evolved from a reports pack into a content-governance suite (2026: a SharePoint Admin Agent with a growing action set, and a content-management assessment surfacing oversharing and site-lifecycle cards). The controls that matter:
| Control | What it does | Use it for |
|---|---|---|
| Data access governance reports | Find oversharing: org-wide links, 'Everyone…' ACLs, sites with broad or unique permissions | The MAP — run first |
| Restricted Access Control (RAC) | Lock a site's access to a specific group even if wider grants exist | Surgical containment of the worst sites (HR, board, M&A) |
| Restricted Content Discovery (RCD) | Keep named sites OUT of Copilot/search grounding while normal access continues | The scalpel: usable site, not groundable |
| Restricted SharePoint Search | Allowlist mode — search/Copilot grounded only on curated sites | The emergency brake during cleanup (blunt) |
| Site access reviews / sharing reports | Owner attestation loops on flagged sites | Making cleanup someone's job |
The runbook (staged)
- Assess before seats: run the SAM oversharing reports + Purview's DSPM-for-AI assessment on day one of the Copilot pilot — the pilot licence unlocks SAM tenant-wide.
- Contain: RAC / Restricted Content Discovery on the red-list sites; Restricted Search only if the red list is unmanageably long.
- Remediate: expire and re-issue org-wide links, fix 'Everyone…' ACLs, apply sensitivity labels to crown jewels (labels then drive Copilot exclusion — the Purview curriculum).
- Institutionalise: site access reviews, tighten the tenant sharing settings
(the sharing-links concept — and serv365 scans
sharingCapabilitynightly, so a regression is a dated drift alert), quarterly SAM re-runs.
What to watch (proofs)
- The before/after: SAM oversharing report counts at pilot start vs 90 days — the metric a steering committee understands.
- The live test: a pilot user asks Copilot for known-sensitive topics — findable before containment, not after; screenshots into the runbook.
- Regression guard: the tenant's
sharingCapability+ default link type in the nightly scan — drifting back to permissive is the alert that matters. - Label coverage on red-list sites: % of crown-jewel content labelled — the durable-control adoption curve.