How to find and fix SharePoint oversharing before Copilot does

SharePoint oversharing can become easier to discover through Copilot. Microsoft 365 Copilot answers from the files a person can already open. It doesn't break your permissions; it uses them. So a budget spreadsheet shared too widely three years ago, which nobody happened to find, becomes something anyone can surface with a question.

That's why "fix SharePoint permissions before Copilot" is on so many IT plans this year. The hard part isn't fixing a file. It's knowing which of hundreds of thousands of files to look at.

SharePoint Advanced Management and Microsoft Purview report on the obvious risks: sites shared with "Everyone except external users", files with "anyone" links, sensitive content found by its labels. Start there. Those reports find access that's broad by any standard.

A breadth report alone does not establish whether access fits your organization. A finance file open to the whole Sales department may need review even when it is not shared with “Everyone”. Microsoft's reports, policies and site-owner reviews help investigate that risk; a model trained on reviewed permission history adds a comparison with your team's past decisions.

Start with files whose access your team has reviewed: Finance sites with Finance and Leadership, HR files with HR, project folders with the project's groups. That history is a record of your rules, even if nobody ever wrote them down.

A model trained on it learns those patterns. Then, for any file, it can say which groups it would expect to have access, and how sure it is. Where the access a file actually has differs from what the model confidently expects, a person should look.

1. Export your permissions. Use the PnP PowerShell permission report, SharePoint's sharing report or a Microsoft Graph JSON export, as it is. Start with one site collection or department.
2. Train a model on it. StayCharted combines the export into one row per file, with the groups that can open it, and checks it for duplicates and personal information. It leaves out Limited Access, site administrators and people who came in through a sharing link.
3. Check agreement on held-out examples. The model report measures agreement with recorded access on files it never trained on. Disagreement can mean a model error or a permission decision worth investigating; it does not prove oversharing.
4. Compare against a trusted pattern. Start with a department whose permissions you have already reviewed. Keep an unchanged copy of the export you want to assess, including file paths or stable IDs and existing access. Fill a copy with suggested access, then compare the two in a spreadsheet using those identifiers. Review confident suggestions that are narrower than existing access; have the file owner confirm the business need before changing anything.
5. Fix what's wrong in SharePoint, then retrain. StayCharted doesn't change permissions; you do. Retrain on the corrected export, and new files get suggestions that follow the cleaned-up pattern.

• It finds files that don't fit your patterns, not every risky file. Use Microsoft's reports for broad access and sharing links.
• It learns your history, mistakes included. If a whole department was overshared consistently, the model learns that as normal. Training on a cleaned-up department first (step 4) is how you avoid it.
• It doesn't connect to your tenant. It works from an export you upload, and it only suggests. Nothing changes until you change it.

Oversharing builds up one new file at a time. Once the existing access is fixed, the same model can suggest access for each new file as it's created, with a person approving anything that widens access. See how with Power Automate →

Microsoft: Prepare for Copilot with SharePoint Advanced Management · Microsoft: Configure a secure and governed data foundation

AI for SharePoint and file permissions · SharePoint access with Power Automate · Access permissions benchmark