SharePoint Advanced Management: fix oversharing before Copilot finds it

SharePoint Advanced Management (SAM) is Microsoft's set of governance controls for SharePoint and OneDrive: oversharing reports, site access reviews, access restrictions and site lifecycle policies. It comes with Microsoft Copilot (formerly Microsoft 365 Copilot) as soon as one user in the tenant holds a Copilot licence, which makes it the natural toolkit for an oversharing clean-up.

Copilot only shows people content they can already open, as Microsoft's Copilot privacy documentation explains. Copilot does not create the overshare. It makes an old one easy to find: the site opened to the whole company for a project and never closed again is now one question away. That is why a Copilot readiness assessment starts with sharing.

If your first Copilot licences have just brought SAM into the SharePoint admin center, the useful question is not what each feature does, but which to use first. This guide follows the oversharing job in the order we work through it, one level deeper than the oversharing practice in our Copilot governance best practices.

What is SharePoint Advanced Management, and who gets it?

SharePoint Advanced Management is a set of governance controls in the SharePoint admin center for SharePoint sites and, for some features, OneDrive. Microsoft's SAM prerequisites give three ways to get it:

• With Microsoft Copilot: as soon as one user in the tenant has a Copilot licence. That user does not have to be a SharePoint admin.
• As an add-on: SharePoint Advanced Management Plan 1.
• With Microsoft 365 E7, which includes it.

The tenant also needs an eligible base plan, such as Office 365 E3, Microsoft 365 E3 or Microsoft 365 E5. A few features still need the add-on even when Copilot is in place: restricting which apps can create sites is one of them.

The features that come with a Copilot licence include oversharing reports, site access reviews, access restrictions and site lifecycle policies. One licensing detail matters for the clean-up: the report on sensitivity labels needs E5 or G5 licences.

In what order should you work with SharePoint Advanced Management?

Work from evidence to restriction. Restrictions applied before you know where the exposure sits can cut off people who need a site, while the real problem stays somewhere else. The order we follow:

1. Find the overshared sites and rank them.
2. Keep the most sensitive ones out of Copilot while you work.
3. Ask site owners to fix access, and record their answers.
4. Restrict the sites that must stay closed whatever links exist.
5. Put policies in place so the problem does not come back.

How long each step takes depends on how many sites you have, how many owners answer and how much sensitive content those sites hold. Oversharing is also only one line of a wider Copilot readiness checklist that covers licences, labels and agents.

Step 1: find and rank the overshared sites

Data access governance reports in the SharePoint admin center show where sites may be overshared. Four of them matter most before Copilot:

• Sharing links: sites where people have been creating "Anyone" links, "People in your organization" links, or links to specific people outside the organisation.
• Content shared with "Everyone except external users": a broad grant that is easy to forget.
• Sensitivity labels applied to files: where labelled content sits (E5 or G5 licences).
• Permission reports: who can reach sites, OneDrive accounts and files, including an oversharing baseline built on permissions.

This is the Map sharing step of our assessment. No single report hands you a priority list, so read them together. A site that appears with broad links, organisation-wide permissions and labelled files goes to the top; broad access with nothing sensitive can wait. Note each site's owner now: you need them in step 3, and a site without one is a finding in itself.

Step 2: keep the worst sites out of Copilot while you work

Restricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing who has access. Microsoft describes it as a temporary control while permissions are fixed, and it applies to SharePoint sites only.

It has a second effect worth knowing. On a site with Restricted Content Discovery, agents are turned off: nobody can create one there or add the site's content to another agent, as Microsoft's page on managing access to agents in SharePoint explains.

Use it on a short list of sensitive sites from step 1, not as a blanket setting. Give each restricted site an exit condition, such as "review complete and broad access removed", and lift the restriction once it is met. A site that stays restricted for good is still overshared, just harder to find.

Step 3: ask site owners to fix access

This is the Let owners decide step of our assessment. A site access review hands the decision to the person who knows the content. From a data access governance report, a SharePoint admin selects one site or several and sends the request. Each owner receives an email about the specific issue the report raised.

The link in that email opens a review page with the detail. There, the owner removes or narrows access with the "Manage access" button, then selects "Complete review" and adds a comment for the admin. On the admin's side, the "My review requests" tab shows which reviews are pending, completed (with name and date) or failed.

Two scoping points shape the plan. Microsoft documents the review as started by an admin and completed by the site owner. And site access reviews cover SharePoint sites, not OneDrive.

Tell owners the reviews are coming, and why, before the first batch goes out. An unexpected request to remove colleagues from a site is easy to set aside.

Step 4: restrict the sites that must stay closed

Some sites should only ever be open to one group: board papers, HR cases, a confidential project. For those, three controls go further than a review:

• Restricted Access Control limits a site, or a OneDrive, to members of chosen Microsoft 365 or Microsoft Entra security groups, even if others already had permissions or a link. A person needs both the permission and the group membership: adding someone to the group does not give them access on its own. Copilot and search respect the restriction.
• Block download policies keep a site or a OneDrive browser-only: people can read files but cannot download, print or sync them. They are set per site with PowerShell, can also cover Teams meeting recordings, and can be tied to a sensitivity label.
• Conditional Access per site: an authentication context applies a Microsoft Entra Conditional Access policy, such as multifactor authentication, to a single SharePoint site.

Restricted Access Control changes who can open the site, so check the membership of the chosen groups with the owner first.

Step 5: stop oversharing from coming back

A clean-up only lasts if someone keeps watching, because new sites, owners and links keep appearing. Site lifecycle management in SAM has three policies that keep sites owned and current:

• Site ownership policy: flags sites with fewer owners than you require.
• Inactive site policy: emails the owners of inactive sites each month. If nobody confirms the site after three notices, it can be set to read-only and later archived with Microsoft 365 Archive. Activity counts across SharePoint, Teams, Viva Engage and Exchange, as the inactive site policy page details.
• Site attestation policy: asks owners to confirm their site at regular intervals.

Each policy can run first in simulation mode, which produces a report. Start there: you see how many sites would be flagged, and which have nobody to ask, before the active mode starts emailing owners.

Two reports then show whether the work holds. Change history reports show what changed on a site or in SharePoint settings over the last 180 days. Agent insights list where agents are created, and the agent access view shows which agents read content on each site.

What happened to Restricted SharePoint Search?

Restricted SharePoint Search is being retired in favour of Restricted Content Discovery, as Microsoft's Restricted SharePoint Search page explains.

The two work in opposite directions: Restricted SharePoint Search relies on an allowed list of sites, while Restricted Content Discovery takes named sites out. If an older pilot plan or runbook still relies on it, rewrite that step around Restricted Content Discovery.

Which SAM feature fits which job?

Each SAM feature fits one step of the clean-up. The last column reflects our working order, to adapt to your tenant.

Where do native controls need a process?

SAM gives you the controls. Running them across hundreds or thousands of sites is organisational work, and five points decide whether it holds:

• Volume. Reviews start from a report, batch by batch. Someone chooses which sites go into each batch, and when the next follows.
• Owners who do not answer. A review stays pending until the owner completes it, and one sent to an owner whose address no longer works is marked as failed. Agree who follows up, and who decides for a site with no owner.
• Exit conditions for temporary controls. Keep a list of sites under Restricted Content Discovery, with the reason and the condition for lifting it, or the list only grows.
• The edges of each control. Site access reviews and inactive site policies cover SharePoint sites, not OneDrive. Private and shared channels have sites of their own, so Restricted Access Control is set on each of them separately, and inactive site policies leave them out. Write down what each control does not reach, and who handles it.
• Evidence. The review tab records who completed each review, when, and their comments. Decide where the record of what was reviewed, when and with what outcome lives, and for how long, before an auditor asks.

How Neptune helps

Neptune is an integrator. We select the governance tool that fits your tenant and your licences, implement it with your team, train your admins and site owners, and support you once it runs: professional services during the project, then customer success.

We keep SAM in place and build on it: the first inventory also covers its data access governance reports where you have them, and Restricted Content Discovery keeps a site out of Copilot where needed while permissions are fixed. The governance tool we put in your tenant then carries the follow-up across every site:

• We map the sites, teams and files Copilot could draw on, starting with sensitive content that carries no label.
• "Anyone" links, external shares and guests are listed site by site and ranked by exposure, so the worst sites are fixed first.
• Shares with no expiry date are listed, so each owner can withdraw the ones a finished project no longer needs.
• Outdated, duplicate and orphaned content is flagged before Copilot can turn it into a wrong answer.
• Owners review who can reach their site by a date agreed with you, keep or remove each risky share, and each decision is recorded with its reason. Requests arrive in Microsoft Teams, so IT is no longer the bottleneck.

We agree with you default sharing settings that make the next overshare less likely. Rules start in report mode and move to enforcement in waves, with owners told what changes and why, and the same checks keep running every day after rollout.

See where this fits in our Microsoft 365 governance approach, or contact us to talk about the sites in your tenant.

Sources

• SharePoint Advanced Management overview
• SharePoint Advanced Management prerequisites
• SharePoint Advanced Management features included with a Copilot licence
• Data access governance reports
• Site access review
• Restricted Content Discovery
• Restricted SharePoint Search
• Restricted Access Control
• Block download policy for SharePoint sites and OneDrive
• Site lifecycle management
• Inactive site policy
• Insights on SharePoint agents
• Monitor agent access to SharePoint and OneDrive
• Manage access to agents in SharePoint
• Data, privacy and security for Microsoft Copilot