SharePoint Advanced Management (SAM) Explained: What a Copilot License Unlocks
Want a second set of eyes?
Get a SharePoint permissions audit from our team
We review who can see what across your sites, flag oversharing before you roll out Copilot, and help you put a cleanup plan and governance in place.
Copilot readiness keeps pointing at the same admin tools: oversharing reports, site access reviews, Restricted Content Discovery. They all sit under one name, SharePoint Advanced Management, and the licensing around it is easy to get wrong. This is the plain version, checked against Microsoft Learn on November 11, 2026. Licensing and feature lists change, so confirm anything you rely on on the pages linked below.
What is SharePoint Advanced Management?
SharePoint Advanced Management (SAM) is a set of governance features in the SharePoint admin center. They help you control three things: sprawl (ownerless, inactive and unreviewed sites), oversharing (content open to far more people than intended) and the content lifecycle (organizing sites, tracking changes). It matters for Copilot because Copilot searches whatever each person can open.
How do you get it?
Per Microsoft's prerequisites page, you need an eligible base license, and then one of three routes:
- Base subscription: Office 365 E3, E5 or A5; Microsoft 365 E1, E3, E5 or A5; or Microsoft 365 GCC, GCC-High or DoD.
- Route 1: a Copilot license. At least one user in the organization is assigned a Microsoft Copilot license. The user doesn't need to be a SharePoint admin.
- Route 2: the add-on. A subscription that includes SharePoint K, P1 or P2, plus the SharePoint Advanced Management Plan 1 add-on (sometimes called SAM standalone), bought through the Microsoft 365 admin center, a Cloud Solution Provider or volume licensing.
- Route 3: Microsoft 365 E7 (the Frontier Suite), which includes E5, Copilot, the Entra Suite and Agent 365.
External users don't need a license.
What does a Copilot license include?
The features below come from Microsoft's feature table, which lists each as available for commercial customers with a Copilot license.
| Area | Feature | What it does |
|---|---|---|
| Overview | Compare SharePoint site policies | Finds sites with similar content but different security policies. |
| Sprawl control | Site ownership policy | Sets the minimum owners or admins per site and notifies when a site doesn't meet it. |
| Sprawl control | Inactive sites policy | Detects inactive sites and notifies their owners. |
| Sprawl control | Site attestation policy | Asks owners or admins for regular reviews of a site's owners, members, permissions and sharing. |
| Oversharing control | Content management assessment | One hub that runs the key reports and recommends next steps. |
| Oversharing control | Data access governance reports | Sharing links, Everyone except external users, site and file permission reports, sensitivity labels. |
| Oversharing control | Site access review | Delegates the review of a report to the owners of overshared sites. |
| Oversharing control | Restricted access control | Limits access to sites (and OneDrive sites) to chosen security groups. |
| Oversharing control | Restricted content discovery | Keeps selected sites out of organization-wide search and Copilot discovery. |
| Oversharing control | Block download policy | Blocks downloads for files in SharePoint and OneDrive sites, and Teams meeting recordings. |
| Oversharing control | Conditional Access policies | Ties a Conditional Access policy to a site through an authentication context. |
| Oversharing control | Enterprise app insights, SharePoint agent insights | Shows non-Microsoft apps that access your content, and offers AI insights on reports. |
| Content lifecycle | Catalog management | Groups sites by region, department, users, information barriers or custom properties. |
| Content lifecycle | Change history, recent admin actions | Tracks changes to sites and tenant settings, and your last 30 admin changes. |
What is not included
- Restricted site creation by apps isn't included with a Copilot license. It needs the SharePoint Advanced Management Plan 1 add-on.
- The sensitivity labels report requires E5 or G5, even though the report sits in the Copilot list.
- Advanced tenant renaming in tenants with more than 10,000 sites requires SharePoint Advanced Management.
- Sovereign clouds: data access governance reports and site access reviews aren't available for Microsoft 365 operated by 21Vianet, even with the licenses.
What E5 alone gets you
Per Microsoft's data access governance page, administrators with Microsoft 365 E5 can access Data access governance reporting but can't view or use the other SAM features. The reports don't include snapshot reports or remedial actions, and activity reports can return only up to 10,000 sites.
The admin roles
- SharePoint Administrator: full control of the SharePoint service, including sites, policies and groups.
- SharePoint Advanced Management Administrator: everything above, plus advanced governance such as viewing metadata (names, paths, URLs) across SharePoint content, removing permissions at scale and managing SAM features.
For Restricted Content Discovery and other PowerShell tasks you also need the latest SharePoint Online Management Shell.
Where SAM stops
Most SAM reports point at sites, and the site access review hands the item-level cleanup to site owners (Microsoft says compliance reasons prevent IT administrators from accessing file-level or item-level details there). One report does list individual files, the one for content shared with Everyone or Everyone except external users. If you want one view of who can reach any site, library, folder or file, with sharing links and group members, exported to Excel, a free tool such as SharePoint Smart Permissions covers that gap, and you can run it inside your own tenant.
Where to start
Run the Content Management Assessment first. Our step-by-step is how to find overshared sites with Data Access Governance reports and the Content Management Assessment, and the question behind it is answered in can Copilot see files I can't open?
Want help setting it up?
See our Copilot readiness and permissions audit, or get in touch.
Related
Frequently asked questions
Do I need a Copilot license for every user to use SAM?
No. Microsoft says SharePoint administrators get SAM capabilities to support Copilot when at least one user in the organization is assigned a Copilot license, and that user doesn't need to be a SharePoint administrator.
Is SharePoint Advanced Management free with Copilot?
The SAM features listed for Copilot licenses are included once at least one Copilot license is assigned. Some features, such as restricted site creation by apps, are not included and need the SharePoint Advanced Management Plan 1 add-on.
Does Microsoft 365 E5 include SAM?
Not by itself. Microsoft says E5 administrators can access the Data Access Governance reporting but can't use the other SAM features, with no snapshot reports or remedial actions, and activity reports that return only up to 10,000 sites.
Do Restricted Access Control and Restricted Content Discovery need an extra license?
Microsoft's table lists both as included with Copilot licenses. Restricted Content Discovery's own page also asks for a Copilot license and SAM availability, so check the prerequisites page for your tenant.
What does the SAM add-on cost?
The Microsoft Learn pages say you can buy it through the Microsoft 365 admin center, a Cloud Solution Provider or volume licensing, and don't list a price. Check your purchasing channel.
Which admin role do I need?
SharePoint Administrator gets you into the admin center. The SharePoint Advanced Management Administrator role adds advanced governance tasks, such as viewing metadata across SharePoint content and removing permissions at scale.
Was this page helpful?
One click. No form, no email address.
Missing something in SharePoint Smart Permissions? Feature requests and bug reports go straight to the developer on GitHub — no account needed to read, free account to post.
Request a featureRelated tool
SharePoint Smart Permissions
Visual permissions audit + Excel export. No PowerShell. Free, MIT licensed, no sign-up.
Keep reading
Can Microsoft 365 Copilot See SharePoint Files I Can't Open?
Copilot only returns what you can already open, so the real risk is overshared content. How permissions, links, labels and discovery controls decide what it finds.
Microsoft 365 Copilot Licensing Explained (2026): Copilot Chat, the $30 Add-On, Copilot Business, Agents and Credits
Copilot is free in some forms and $30 per user in others, with agents billed by usage on top. Here is what each license includes, what you need first, and how to buy only the seats you will use.
Restricted Access Control and Overshared Sites: Preparing SharePoint for Microsoft 365 Copilot
Copilot exposes oversharing that is already there. Here is how the three SharePoint restriction controls differ, when to use each, and how to set up Restricted Access Control with PowerShell.
Want a second set of eyes?
Get a SharePoint permissions audit from our team
We review who can see what across your sites, flag oversharing before you roll out Copilot, and help you put a cleanup plan and governance in place.
About the author
Sean Regan
SharePoint & Microsoft 365 consultant with 20+ years of hands-on experience building SPFx web parts, migration tooling and tenant-grade automation. Maintainer of the open-source SharePoint Smart Solutions suite.