SharePoint Advanced Management

Before you switch on Copilot, there is one question worth losing sleep over: what in here is overshared? Not in theory — in fact. Which sites are open to the whole company. Which files a long-gone contractor can still reach. Which “anyone with the link” shares are still live from a project that ended two years ago. Most admins have no way to answer that, so they cross their fingers and hope.

SharePoint Advanced Management has a set of reports that answer it precisely. They are sitting in your admin center, and almost nobody runs them. They are called Data Access Governance reports, and this is the tour.

Where they are

In the SharePoint admin center, expand Reports and select Data access governance. Everything below lives on that one page. It splits into two kinds of report, and you want both.

Snapshot reports: the baseline

Snapshot reports show your organisation as it stands right now, the day you run them. Four of them, and the first two are the ones that matter most.

Site permissions across your organisation. Microsoft marks this one “recommended,” and it earns it. It analyses every SharePoint and OneDrive site and shows you which have the broadest access, the sites open to thousands of users, to external guests, or to “Everyone except external users.” This is your first look at where the exposure is concentrated. Run it, and the sites that need attention rise straight to the top.

Sites and files shared via special SharePoint groups. This is the one to really pay attention to. Where the report above tells you which sites are overshared, this one tells you exactly which items are effectively public, through the “Everyone except external users” or “Everyone” groups, and how that access was granted. Down to the file. That precision is the difference between “we have an oversharing problem somewhere” and a list you can actually script a cleanup against.

Site permissions for a user. Pick a person; get every site they can reach, and how, whether it was granted to them directly or inherited through a group. This is the question you dread in an access review or a leaver process, and it used to mean an afternoon of clicking. Here it is a report.

Sensitivity labels for files. Which sites hold files carrying a given sensitivity label, so you can confirm the sensitive stuff is where you think it is and protected the way you think it is.

Activity reports: what changed lately

Activity reports cover the last 28 days — the oversharing that happened recently, so you can catch it as it emerges rather than discovering it a year later.

Sharing links. The sites where people created the most new sharing links lately, across all the types: “anyone” links, “people in the organisation” links, and specific-people links. This is oversharing in the act.

Shared with ‘Everyone except external users’. The sites where content was shared with your entire internal organisation in the last 28 days. Broad internal exposure, as it happens.

How to actually use them

The two kinds work together. Run the snapshot reports quarterly to keep a true picture of your baseline exposure. Run the activity reports monthly to catch new risk before it settles in. Start with site permissions across your organisation; it tells you where to look, and everything else drills in from there.

And the reports are not a dead end. From a finding, you act, without leaving the governance tooling:

• lock an overshared site to a single group with Restricted Access Control;
• check the change history report to see who opened the access up, and when;
• or delegate the cleanup to the site owners with a site access review, instead of doing it all yourself.

That is the whole loop: find the oversharing, decide what to do, enforce it. It is Copilot readiness in three steps.

The licensing catch

The full set needs SharePoint Advanced Management, which you have if anyone in the tenant holds a Microsoft 365 Copilot licence, or you have bought the add-on. There is one partial exception worth knowing: an organisation with Microsoft 365 E5 but no SAM can see the activity reports, capped at 10,000 sites, but not the snapshot reports and not the one-click remedial actions.

If none of this is switched on for you

Plenty of organisations have neither a Copilot licence nor the add-on, so this whole page is dark for them. If that is you, the two questions these reports answer, “every site this one person can reach” and “which sharing links are exposing content,” are exactly the two I built free tools for.

The User Access Explorer gives you the site-permissions-for-a-user view. The sharing-link auditor gives you the sharing-links view, and lets you revoke them. Not as polished as Microsoft’s reports, but free, and they answer the question that actually matters before you turn Copilot on: who can already reach what.

SharePoint Advanced Management has a long feature list. Open the Advanced management page and you will count more than twenty capabilities, which is its own kind of problem: a list that long tells you nothing about where to start. Most of them you will open once, nod at, and never touch again. A handful you will come back to every week. This is about that handful, grouped the way Microsoft groups them: preventing oversharing, controlling sprawl, and keeping an audit trail.

Preventing oversharing

This is the part that matters for a Copilot rollout, and it is where SAM earns most of its keep.

Data Access Governance reports. If you use one thing in SAM, use these. They are a set of reports that show how your content is actually exposed, and each answers a question that used to take a day of clicking:

• the permission state report is a tenant-wide snapshot of how broadly your sites are shared;
• the per-user report lists every site a given person can reach and how they got access, which is the question you dread in an access review;
• the sharing links report surfaces the sites where people created the most new links lately;
• the sensitivity label snapshot shows how your labels are distributed;
• and the Everyone except external users report is the single most useful line in here: the content shared with, effectively, the whole company.

These are your oversharing X-ray. Run them before you turn Copilot loose, because they tell you exactly what it is about to surface.

Restricted Content Discovery. Hide a messy site from Copilot and organisation-wide search while you clean it up, without changing anyone’s access. It is the light-touch cover, and I went into it in detail in Restricted Content Discovery vs Restricted SharePoint Search.

Restricted Access Control. The heavier control: lock a site so only members of a specific security group can open it, even if someone else has a direct grant or a sharing link. It is a real access boundary, and it has its own write-up in Restricted Access Control for SharePoint.

Block download. Let people read a site in the browser but not move or download the files out of it. It also covers Teams meeting recordings, which is where a lot of sensitive material quietly walks out.

Site access reviews. This is the one that makes the reports actionable. You found the overshared sites in the Data Access Governance report; now, instead of fixing them all yourself, you delegate the review to the actual site owners, who know whether that access is still needed. It is the difference between a report you feel bad about and a cleanup that actually happens.

Controlling sprawl

Three policies stop your tenant slowly filling up with orphaned and forgotten sites.

The site ownership policy flags sites that have no real owner, or fewer owners than you require, and nudges someone to take responsibility. The inactive site policy finds sites nobody has touched in months and emails the owners to confirm or let go. And site attestations ask owners to periodically confirm that a site is still needed and its access is still right, so the cleanup does not depend on you remembering to chase it.

Run all three in simulation mode first. You want to see what they would flag before they start emailing people.

Keeping an audit trail

Boring until the day you need them, then invaluable.

Change history reports track changes made to individual sites, and to organisation settings, over the last 180 days. When someone asks “who turned sharing back on for this site, and when,” this is the answer. Recent actions is the shorter version: the last changes you made to a site’s properties in the last 30 days, so you can retrace your own steps after a busy afternoon in the admin center.

And a newer one worth a look now that anyone can build one: insights on agents in SharePoint, which show you the agents people have recently spun up across your sites, and which sites are accumulating the most. Agent sprawl is the next version of site sprawl, and it is quietly starting.

Where to start

If the feature list is overwhelming, ignore most of it and start in exactly one place: the Data Access Governance reports. They tell you where your oversharing is. The site access reviews let you delegate the fix. And Restricted Content Discovery or Restricted Access Control hold the line while the cleanup happens. That loop is the whole of Copilot readiness, and it is sitting in your admin center already.

The one thing none of it does is the judgement call underneath it all: deciding who should be able to reach what. SAM will show you the answer and help you enforce it. It will not make the decision for you.

And if you are one of the organisations without a Copilot licence or the add-on, so none of this is switched on for you, that oversharing view is exactly the gap I built User Access Explorer to fill, for free.