Set up new SharePoint permissions the way you always have.

Every new site, file and starter is another permission decision.

SharePoint admins make the same decisions over and over: which groups get this new site, who can open this library, what a new starter in Finance needs. The answers live in your head and in years of past assignments, not in a rulebook. When the decisions don't keep up, files end up shared too widely. AI assistants such as Copilot then show them to anyone who has access.

Rules don't solve it. A permission matrix needs someone to write it, and it goes out of date the week it's finished.

Your permission history is the rulebook.

Every access you've granted is an example. StayCharted trains a private model on those examples, so it learns the patterns you follow without anyone writing them down: Finance sites get Finance and Leadership, HR files stay with HR, and each team's starters get their team's groups. For each new item it suggests the access, with a confidence, and anything it's unsure about comes back to you.

Three ways to use it

1. New sites and files: who should have access One row per existing site, library or file: its name, folder path, owner and department. The answer column is the groups that have access, for example "Finance Team; Leadership". StayCharted suggests the groups for each new one.

2. New starters and movers: which groups they need One row per person: department, job title, manager, location. The answer column is membership (yes or no) for a group, with one yes/no membership model per group, or the set of groups they hold. StayCharted suggests the groups for each new starter or mover.

3. Sensitivity labels: Public, Internal, Confidential If you use Microsoft Purview labels, train on the label each file already has. StayCharted suggests a label for each new or unlabelled file, and your label policies apply the protection.

How it works

STEP 1. Export your permission history. A SharePoint permissions or sharing report, a PowerShell export of site and library permissions, or your group membership list. Put one row per item, with the access it has in the answer column.

STEP 2. Check your examples. StayCharted points out duplicates, access combinations with too few examples, and personal information in names and paths. Fix each in a click.

STEP 3. Train and test. See how often the model suggests exactly the access you gave, on items it never saw during training. See which categories it confuses and how many items you would need to check.

STEP 4. Suggest access for new items. Upload the list of new sites, files or starters. Each row gets suggested access and a confidence. Apply the confident ones in SharePoint or with your own PowerShell scripts.

ONGOING. You check the unsure ones. On Essentials and Business, suggestions below the confidence you choose go to the Review Queue. Confirm or correct them, and the next version learns from your corrections.

A wrong permission can expose a file. So it's built not to.

• You approve any suggestion that would widen access. StayCharted only suggests; nothing changes in SharePoint until you or your script applies it.
• Unsure suggestions get checked. On Essentials and Business, anything below your confidence cutoff waits in the Review Queue.
• It suggests, you apply. StayCharted doesn't connect to your tenant or change permissions. You apply what you approve.
• Reviews are recorded. Every Review Queue answer appears in Activity, with who gave it.
• Your history stays yours. It trains only the models in your workspace, and uploads are deleted automatically on the retention schedule in our Privacy Policy.

Tested on 36,000 people's group access.

On Amazon's public access dataset, StayCharted learned which of 10 common groups each person should be in, from department, job and manager alone. This tested group membership for people, not file or site permissions.

Measured on 7,270 people it never trained on:

• It was right 97.8% of the time.
• It gave access wrongly to fewer than 1 in 100 of the people who didn't have it.

Projected with review:

• If a person checks the 6% of answers it's least sure of and corrects the wrong ones, 99.4% would be right.

Read the access benchmark →

Works with

Frequently asked questions

Does StayCharted change SharePoint permissions (ACLs) itself? No. It suggests access for each new site, file or person, and you apply what you approve in SharePoint, Entra ID or with your own scripts. It doesn't connect to your tenant.

A permission is a list of groups. How does it predict that? In one of two ways. The whole set of groups is one answer (for example "Finance Team; Leadership"), which works when the same sets repeat, as they usually do per team and folder. Or there's one model per group, which answers "should this group have access?" for each one.

What do we need to start? A few hundred past decisions of each kind you want it to learn. Around 20 or more examples of each access set or group is a good start.

How is this different from Microsoft's own tools? SharePoint Advanced Management and Purview report on oversharing and apply policies you define. StayCharted learns your own past decisions and suggests the next ones. You can use both: Microsoft's tools to find and enforce, StayCharted to decide new access the way you always have.

Which plans include it? Every plan, Free included. The Free plan includes Classifier Models and one AI Classifier Model, so you can train on your own permission history at no cost. Essentials and Business add more models and the Review Queue.

Start with one site collection.

Export the permissions of one department's sites, train a model, and see how often it agrees with the access you gave before you use it on anything new.

Start free ↗

---