Author
Prem Chandran
Is Your SharePoint Ready for Copilot? What SAM Reports Reveal
In this article
- Everyone Wants Copilot. Do You Know What It Can See?
- Why Does SharePoint Governance Matter More Than Ever?
- What Is SharePoint Advanced Management?
- Which SAM Reports Can Help Identify Risks?
- What Risks Do Organizations Commonly Discover?
- How Do You Move From Insight to Action?
- What Business Outcomes Can You Expect?
- Final Takeaway: Good Copilot Experiences Start With Good Governance
Everyone Wants Copilot. Do You Know What It Can See?
Microsoft 365 Copilot does not create new access to your data. Copilot and agents retrieve data from Work IQ and Microsoft Graph and respect existing permissions, sharing settings, and policies. That is good news for security. It is uncomfortable news for any organization that has not reviewed those permissions in years.
If a file is shared with the whole company, Copilot can surface it for any employee who asks the right question, unless you have restricted Copilot from that site. Before AI, that exposure often stayed hidden because people rarely stumbled across it. With Copilot, a plain-language prompt can find content in seconds.
So the real question is not whether Copilot is safe. It is whether your Microsoft 365 environment is ready for what Copilot will find.
Why Does SharePoint Governance Matter More Than Ever?
SharePoint governance now shapes both security and the quality of AI answers. Copilot does not know which content is outdated, duplicated, or no longer relevant. It works with what it can reach. An old policy can be quoted as if it were current, and a forgotten permission can become visible in a single prompt.
Industry research points the same way. Gartner’s Key Insights From the 2025 Microsoft 365 Copilot Survey, published June 2, 2025, reported that 71% of organizations identified security and governance as a top challenge in deploying Microsoft 365 Copilot. In the same survey, 67% listed content sprawl and 63% listed oversharing and data loss among their top three risks.
What Is SharePoint Advanced Management?
SharePoint Advanced Management is a set of Microsoft governance tools for SharePoint and OneDrive. It is built to help administrators reduce content sprawl, control oversharing, and manage the content lifecycle. You can find it in the SharePoint admin center, including the Reports > Data access governance page and the Advanced Management hub.
Microsoft states that if an organization assigns at least one Microsoft 365 Copilot license to a user, SharePoint administrators get access to the SAM features that support a Copilot deployment. Microsoft publishes the list of included features, so confirm what applies to your tenant before you plan your work.
SAM does not clean up your environment by itself. Think of it as the visibility and control layer that tells you where to look first.
Which SAM Reports Can Help Identify Risks?
The data access governance reports help you discover sites that contain potentially overshared or sensitive content. The Content Management Assessment pulls findings together in one guided place. Here is what each one can reveal.
| Report | What it shows | What it can reveal |
|---|---|---|
| Content Management Assessment | A suite of reports with findings and recommendations, which you can re-run to track progress | Potentially overshared content, inactive or ownerless sites, and a view of Copilot readiness |
| Site permissions across your organization (snapshot) | The permission structure across SharePoint and OneDrive sites | Sites with thousands of users, external guests, or Everyone except external users (EEEU) access |
| Site permissions for users (snapshot) | Every site a selected person can reach | Access that was granted directly or inherited through a group, useful for leaver and access reviews |
| Sensitivity labels for files (snapshot) | Which sites contain files with a given sensitivity label | Whether labelled content sits where you expect, and which sites may need tighter controls |
| Sites and files shared via special SharePoint groups (snapshot) | Item-level detail on content shared with Everyone or Everyone except external users | The specific files and folders that are effectively open to the whole organization |
| Shared with Everyone except external users (activity) | The top 100 sites with the most EEEU sharing in the last 28 days, with privacy, label, and external sharing settings | Recent oversharing trends, so you can act before they spread |
| Sharing links (activity) | Recent sharing link activity across sites | Where broad sharing links have been created recently |
How do snapshot and activity reports work together?
Snapshot reports show where you stand today. Activity reports show what has changed recently. Microsoft suggests running the site permissions report first to set a baseline, then using the EEEU activity report to monitor ongoing sharing. The item-level report for content shared with Everyone groups was scheduled to begin rolling out in August 2026, according to Microsoft Message Center item MC1450131.
What does the Content Management Assessment add?
It gives administrators a simple, guided starting point with recommendations for remediation. Microsoft advises that you re-run the assessment every 30 days to track progress and catch new issues.
What Risks Do Organizations Commonly Discover?
These four patterns tend to appear when organizations look closely at their SharePoint and OneDrive environments. The scenarios below are illustrative, not client results.
“Everyone Except External Users” permissions
EEEU is a built-in group that includes every internal user. Sharing with EEEU grants access to all current and future internal users, including contractors with member accounts, so a public site or a broadly shared folder can expose content far beyond its intended audience. The permissions and EEEU reports help you find both the sites and the items.
Legacy project sites
Project sites often outlive the projects. Nobody owns them, nobody reviews them, and Copilot can still draw on them. Outdated content can then appear in answers as if it were current. Inactive site and site ownership policies help you find and act on these sites.
Sensitive HR files in broadly accessible locations
A salary review or performance document saved to a team site that was once set to public is a classic example. Pairing the site permissions report with the sensitivity labels report helps you see where labelled content lives and who can reach it. That report only finds files that are already labelled, so use Microsoft Purview Data Security Posture Management (DSPM) data risk assessments to find sensitive content that has no label.
Guest access sprawl
External guests are added for a project and never removed. The site permissions report highlights sites with external guests, and site attestation policies or SAM site access reviews give owners a way to confirm who should still have access.
How Do You Move From Insight to Action?
Reports give you evidence. The value comes from what you do next. A practical sequence looks like this:
- Run the baseline. Start the Content Management Assessment and the site permissions report to see where exposure is concentrated. Allow time, because depending on tenant size these can take several days to complete.
- Prioritize. Focus first on sites with the broadest access, external guests, or sensitive content.
- Assign owners. Use site ownership and site attestation policies so a named person reviews each priority site.
- Fix permissions. Remove unnecessary EEEU grants, tighten sharing links, and review guest access.
- Contain while you clean up. Restricted Content Discovery can limit what Copilot surfaces from selected sites in the short term. It is a temporary control, not a substitute for correcting permissions.
- Retire stale content. Use site lifecycle policies and archiving (Microsoft 365 Archive is billed separately) so Copilot references current content, and pair them with Microsoft Purview retention where needed.
- Repeat. Re-run the assessment regularly and build the review into ongoing governance.
For a deeper look at what Copilot can surface from your own tenant, see our webinar What Will Copilot Find in Your Microsoft 365 Environment?.
What Business Outcomes Can You Expect?
Acting on SAM findings is about outcomes, not features. Organizations that do this work well aim for:
- Greater confidence deploying Copilot, because you know what it can reach.
- Reduced oversharing risk, by closing broad access before it is discoverable by AI.
- Improved security and governance posture, with clear owners and regular reviews.
- Better visibility into SharePoint and OneDrive environments, backed by reports instead of guesswork.
- More effective Microsoft 365 investments, since Copilot works from cleaner, current content.
- Faster AI adoption with lower organizational risk, because governance is done before rollout, not after an incident.
FAQs
Does Microsoft 365 Copilot ignore SharePoint permissions?
No. Copilot respects existing permissions, sharing settings, and policies. If a user can access content, Copilot can help them find it.
Is SharePoint Advanced Management included with Microsoft 365 Copilot?
Microsoft includes a defined set of SAM features when at least one Microsoft 365 Copilot license is assigned in the tenant. It is not a blanket entitlement to every SAM capability, so check Microsoft’s current feature list for your environment.
What is “Everyone except external users” in SharePoint?
It is a built-in group that includes all internal users and excludes guests. Sharing content with it makes that content available to the whole organization.
How often should we run these reports?
Microsoft recommends re-running the Content Management Assessment every 30 days. Activity reports cover the last 28 days, so a regular cadence keeps results meaningful.
Do the reports fix oversharing automatically?
No. They provide the evidence. Owners and administrators still need to review permissions, adjust sharing, and manage stale content.
