How to Find Overshared SharePoint Sites with Data Access Governance Reports and the Content Management Assessment

Before a Copilot rollout, the question is which sites are open to far more people than they should be. Microsoft builds the answer into the SharePoint admin center. This guide walks through it in the order that works (see Microsoft's data access governance documentation). Menus move around, so use the linked Microsoft pages if a label has changed.

What you need first

• SharePoint Advanced Management, which Microsoft provides once at least one user has a Copilot license (see what a Copilot license unlocks).
• The SharePoint Administrator role, or SharePoint Advanced Management Administrator for the advanced tasks.
• If the reports don't work as described, check the known-issues section of Microsoft's page. It points to the "Display concealed user, group, and site names in all reports" setting in the Microsoft 365 admin center, which only a Global Administrator can change.

Step 1: Run the Content Management Assessment

In the SharePoint admin center, open Advanced Management and select Start assessment. It runs these reports for you, per Microsoft:

• Inactive sites: no activity in the past 180 days.
• Site ownership: sites with no owner or only one owner.
• Broken inheritance: sites where permission inheritance is broken.
• Unrestricted internal sharing through Everyone except external users.
• Unrestricted sharing through sharing links.

Depending on tenant size this takes between 2 hours and 72 hours. The result is a dashboard with impacted sites, findings and recommended next steps. Nothing is changed for you. Plan to rerun it about every 30 days.

Step 2: Run the site permissions report

Expand Reports and select Data access governance. Start with the snapshot report Site permissions across your organization, which Microsoft recommends. It shows the permission structure of every SharePoint and OneDrive site, so you can see which sites reach the most people: thousands of users, external guests or Everyone except external users.

There is also a site permissions for users report, which lists every site a chosen person can reach, directly or through groups.

Step 3: Run the activity reports

Two activity reports cover the last 28 days:

• Sharing links: sites where the most new links were created, including "Anyone", "People in the organization" and "Specific people" links.
• Shared with Everyone except external users: sites where content was shared with all internal users in that period.

Microsoft suggests snapshot reports quarterly and activity reports monthly. If your tenant has no SAM, you must turn on data collection first, and reports then contain data only from that point.

Step 4: Find the exact files exposed to everyone

The snapshot report Sites and files shared via special SharePoint groups lists the sites, folders and files exposed through Everyone except external users or Everyone, and how access was granted. Microsoft positions it so you can accelerate cleanup with scripting instead of relying on site owners. For the background on that group, see auditing Everyone except external users.

Step 5: Fix what you found

• Restrict access now: Restricted Access Control limits a site to the members of chosen security groups.
• Buy time: Restricted Content Discovery keeps a site out of organization-wide search and Copilot while you review. It doesn't change permissions. See what it does and doesn't do.
• Find what changed: the change history report shows recent permission changes that may have caused the oversharing.
• Hand it to the owners: a site access review, below.

Start a site access review

1. Under Reports, select Data access governance, then View reports for a supported report.
2. Choose the sites to review and select Initiate site access review.
3. Select Customize and preview email, write a clear message to the owners, and send.

Per Microsoft, you can start reviews for up to 100 sites from the web view (use PowerShell for more), and up to 1,000 a month from the Site permissions report. Each owner gets an email tailored to the finding and a page where they use Manage access to remove people, group memberships or links, then select Complete review. Track them on the My review requests tab. Reviews work for SharePoint sites, not OneDrive accounts.

What these reports don't give you

Most of them point at sites, and the item-level cleanup is left to owners through site access reviews. If you also want to open one site, library, folder or file and see exactly who can reach it, including sharing links and group members, with an Excel export, that's what SharePoint Smart Permissions does for free, inside your tenant. For a quick check of how exposed you are, take the free oversharing self-assessment.

Want someone to run it with you?

See our Copilot readiness and permissions audit, or get in touch.

Related

• SharePoint Advanced Management explained
• Restricted Access Control and overshared sites
• Copilot data readiness checklist