SharePoint Advanced Management vs. Microsoft Purview: Which Controls Fix Oversharing, Sensitive Data Exposure, and AI Audit Gaps?

THE SHORT ANSWER

SharePoint Advanced Management (SAM) controls the container: which SharePoint sites exist, who can reach them, and whether Copilot can discover them. Microsoft Purview controls the content: how sensitive it is, which policy follows it, and what is recorded when AI uses it. Use SAM first to fix oversharing, use Purview to protect sensitive data and close AI audit gaps, and plan to run both.

• Why oversharing, sensitive data exposure, and AI audit gaps are three different problems
• What SharePoint Advanced Management does
• What Microsoft Purview does for Copilot
• SAM vs. Purview: which control fixes which problem
• Which one to start with
• Benefits of using both together
• Risks and limits to plan for
• Best practices from our Copilot readiness work

Microsoft 365 Copilot does not create new access to your data. Copilot and agents retrieve data from Microsoft Graph and respect existing permissions, sharing settings, and policies. That is good for security, and it is why Copilot rollouts tend to expose weaknesses that were already there.

Those weaknesses fall into three groups, and each one needs a different control:

• Oversharing means access is broader than it should be. Think “Everyone except external users” grants, old guest accounts, and sharing links that outlived their purpose.
• Sensitive data exposure means content is not classified or protected, so nothing tells Copilot, or a user, to handle it carefully.
• AI audit gaps mean you cannot show who used Copilot against which content, or investigate an incident after the fact.

Treating all three as one “permissions problem” is the most common reason readiness projects stall. SAM and Purview each cover a different part of the picture.

HOW WE HELP: START WITH THE RIGHT QUESTION

At Creospark, we start Copilot readiness projects by separating the problems, so each one gets the right control and the right owner. Our webinar recap, What Will Copilot Find in Your Microsoft 365 Environment?, shows how these problems surface in real tenants.

SAM is a set of governance tools for SharePoint and OneDrive. It helps administrators manage content sprawl, manage the content lifecycle, and prevent oversharing. Administrators work in it mainly through the SharePoint admin center.

How does SAM help you find oversharing?

Data access governance reports let you discover sites that contain potentially overshared or sensitive content. Snapshot reports show the current permission structure across sites and how many labeled files each site holds. Activity reports show recent sharing links and content shared with Everyone except external users. The Content Management Assessment pulls findings into one guided view, and Microsoft advises re-running it every 30 days.

How does SAM help you contain risk while you clean up?

Restricted Content Discovery limits discovery of content from specific SharePoint sites in organization-wide search and Copilot responses. It applies to SharePoint sites only, not OneDrive accounts. It does not change existing permissions, so people who already have access can still open the files directly. Microsoft positions it as a temporary control and advises using it selectively, because overuse reduces what Copilot can draw on. Restricted Access Control goes further by limiting a site to members of specified groups.

How does SAM help you fix the cause?

Site access reviews hand cleanup to site owners, who know their content best. Site ownership, inactive site, and attestation policies find ownerless and stale sites and ask a named person to confirm they should still exist. These controls address the human side of oversharing: nobody owns the site, so nobody fixes it.

Do you already have SAM?

If you have Copilot, you have part of it. Microsoft includes a defined set of SAM features when at least one Microsoft Copilot license is assigned, and SAM is also available as an add-on. It is not a blanket entitlement to every capability, so confirm the current feature list for your tenant. Microsoft 365 E5 on its own gives IT administrators access to data access governance reporting, but not the other SAM features or remedial actions.

HOW WE HELP: SEE YOUR OVERSHARING RISK RANKED

In our Microsoft 365 Copilot Readiness Assessment, we review data access and oversharing risk using Microsoft’s own governance signals, confirm your licensing, and rank your oversharing risks by priority. To see how permission drift plays out in a high-confidentiality setting, read Why Overshared SharePoint Sites Are an AI Risk for Law Firms.

Purview works at the content layer. Microsoft lists DSPM, auditing, data classification, sensitivity labels, data loss prevention, Insider Risk Management, communication compliance, eDiscovery, and Data Lifecycle Management as supported for Microsoft 365 Copilot interactions.

How does Purview reduce sensitive data exposure?

Sensitivity labels travel with the content and drive protection such as encryption and access restrictions. Data loss prevention for Copilot works in two ways: it can exclude files and emails with selected sensitivity labels from Copilot processing, and it can block prompts that contain sensitive information types, such as credit card or passport numbers. The catch is that the label-based controls depend on classification. If content is unlabeled, those policies have nothing to act on.

How does Purview show where the risk is?

Data Security Posture Management (DSPM) is Microsoft’s front door for discovering and securing AI usage. Its data risk assessments help identify issues that could result in oversharing of data, including a default weekly assessment of your 100 most active SharePoint sites, and offer one-click policies to act on the findings. Sites outside that top 100 need a custom assessment.

How does Purview close AI audit gaps?

Purview Audit records user and admin activity, including interactions with AI tools like Microsoft 365 Copilot. DSPM’s activity explorer lets security teams review AI interactions, and eDiscovery extends investigation coverage to Copilot activity. Without auditing, the organization has no durable record to answer an incident or a regulator’s question. Audit is on by default for most enterprise tenants, but verify it, and confirm retention against your license tier.

How does Purview handle stale content?

Data Lifecycle Management and retention labels decide how long content stays around, but they keep content by default and only remove it when you configure a delete action. Paired with SAM’s inactive site policies, which can set sites to read-only or archive them, they help keep outdated content from being quoted as if it were current. Our checklist Copilot Sees Dead Files: 5 AI Checks, From Governance to Scams shows why old content matters once Copilot can find it in seconds. 

HOW WE HELP: MAKE PURVIEW WORK IN PRACTICE

Purview protects only what is classified and rolled out, and many tenants have labels configured with almost nothing labeled. We help organizations plan labeling, data loss prevention, and audit as part of Copilot readiness. For a quick self-check, read Something’s Living in Your Data: 5 Signs Your Sensitive Info Isn’t as Protected as You Think, and for a walkthrough of how these controls fit together, see Building Trust and Readiness for Microsoft 365 Copilot.

This table shows which tool leads for each problem. “Primary” means the control is built for that job. “Supporting” means it contributes but should not carry the job alone.

The pattern is consistent. SAM answers “who can reach this site, should it still exist, and who owns it.” Purview answers “what is this content, how sensitive is it, and what happened when AI used it.”

Start with SAM when Copilot deployment is close and your content is not yet labeled. SAM works at the site level, so it needs no classification to reduce exposure. Run the baseline reports, find the riskiest sites, and use Restricted Content Discovery on high-risk sites while owners review access.

Start Purview in parallel when possible, not afterward. Confirm auditing is on, run a DSPM data risk assessment, and publish sensitivity labels. Microsoft’s oversharing blueprint follows a similar path: assess with SAM data access governance and Purview DSPM, deploy controls in stages, then operate and monitor.

A simple rule of thumb: if the question is about a site, begin with SAM. If it is about a file, a label, or a record of activity, begin with Purview.

• Fewer wrong answers. Cleaner permissions and current content mean Copilot draws on what people should see.
• Defense in depth. SAM narrows who can reach content. Purview protects the content itself if access is still too wide.
• Evidence you can show. Audit and DSPM reporting back up governance claims with records instead of assumptions.
• Safer expansion. Controls and monitoring are in place before access widens, not after an incident.

• Neither tool fixes oversharing automatically. SAM reports provide evidence. Owners and administrators still decide and act.
• Restricted Content Discovery is temporary. It hides content from discovery but does not correct permissions, and it does not cover OneDrive.
• Purview’s label-based controls depend on classification. Unlabeled content gets little protection from them, which is why labeling work should start early.
• Licensing differs by capability. SAM and Purview features vary by license tier. Confirm what each user group has before you plan.
• Overcorrecting breaks real work. Review high-risk findings before you remediate, and log every governance change.

1. Audit your licenses first. Inventory who has Copilot, E3, E5, or add-ons, and match capabilities to the teams that will use them.
2. Run the SAM baseline. Start the Content Management Assessment and the Site permissions for your organization report early, because first runs can take several days.
3. Turn on and verify Purview Audit. Confirm it is collecting Copilot activity and that retention fits your needs.
4. Prioritize by exposure. Focus on sites with the broadest access, external guests, or sensitive content.
5. Assign named owners. Use site ownership policies and access reviews so a person is accountable for each priority site.
6. Contain, then fix. Apply Restricted Content Discovery to the riskiest sites while you correct permissions.
7. Label what matters. Start publishing sensitivity labels alongside the SAM work, and add DLP for Copilot where regulated data lives.
8. Repeat on a schedule. Re-run the Content Management Assessment every 30 days and the data access governance snapshot reports quarterly, and review DSPM results as the weekly assessment refreshes.

HOW WE HELP: LEARN FROM OUR EXPERTS

Our CIO, Eric Overfield, a Microsoft MVP and Regional Director, presented these steps in our webinar on what Copilot will find in your environment. Read the webinar recap for the readiness gaps, the self-assessment questions, and a practical roadmap.

Knowing which control fixes which problem is the easy part. Running both well, in the right order, across a live Microsoft 365 tenant is where most teams want an experienced partner. We are a Microsoft Solutions Partner for Modern Work and a Copilot & Agents Partner, and we help organizations get their environment ready for Copilot and AI, with security, governance, and adoption built in from day one. Here is how we help:

• Assess before you roll out. Our Microsoft 365 Copilot Readiness Assessment is a structured, remote, four-week engagement. We review data-access and oversharing risk using Microsoft’s own governance signals, confirm your licensing, and evaluate governance and security posture across Purview and your tenant configuration. You receive a readiness score and your oversharing risks ranked by priority.
• Turn findings into a plan. The assessment ends with a phased roadmap and a live demonstration your leadership can rally behind, so the SAM and Purview work that follows is sequenced by risk instead of guesswork.
• See Copilot working on your data. We stand up a working Copilot pilot for up to 10 of your users, so leaders see it running in your own environment before committing to a full rollout.
• Keep it governed after launch. Our Managed IT services are built around four outcomes: Secure, Supported, Governed, and AI Ready. That means proactive security management, identity and access controls, and ongoing support, so permissions do not drift back to where they started.
• Drive adoption and build what is next. Through our Copilot and AI services, we pair change management and training with hands-on options such as a Copilot Agent Jumpstart, so your teams trust and use the tools you have secured.

If you want to see what an assessment could uncover in your tenant before committing to anything, we also offer a complimentary Microsoft 365 Security & AI Readiness Assessment that covers security vulnerabilities, licensing optimization, governance and access gaps, and Copilot and AI readiness.

Do I need both SharePoint Advanced Management and Microsoft Purview?

For a complete answer, yes. They cover different layers. SAM governs sites and access. Purview governs content, protection, and audit. Most organizations see the best results when both are in place.

Which one fixes oversharing?

SAM does most of the heavy lifting for site-level oversharing through reports, access reviews, and access restrictions. Purview supports it with DSPM risk assessments and label-based protection.

Does Purview audit Microsoft 365 Copilot activity?

Yes. Purview Audit records AI interactions, and DSPM provides an activity explorer to review them. Verify that auditing is enabled and check your retention period.

Can I use Restricted Content Discovery instead of fixing permissions?

No. It limits discovery and does not change permissions. Treat it as a short-term control while you correct access.

Do I need sensitivity labels before I deploy Copilot?

Not to start, but begin labeling in parallel. SAM controls work at the site level without labels, and labeling takes time to roll out. Labels become important for long-term, content-level protection and for DLP policies that rely on them.

Is SharePoint Advanced Management included with Microsoft 365 Copilot?

A defined set of SAM features is included when at least one Copilot license is assigned. Check Microsoft’s current feature list for your tenant, since not every capability is included.

TL;DR

SAM fixes the container: who can reach a site and whether Copilot can discover it. Purview fixes the content: classification, protection, and an audit trail of AI use. Start with SAM for oversharing, run Purview alongside it for sensitive data and audit, and review both on a regular cadence.

Not sure where your Microsoft 365 environment stands before Copilot?

We help organizations assess oversharing, sensitive data exposure, and audit readiness, then build a practical plan to close the gaps.