Why does AI search expose oversharing?
Microsoft states that Copilot only surfaces organisational data that a user has at least view permission for, and SharePoint search results are security trimmed in the same way. That protects files with correct permissions. It does nothing for files that were shared too widely in the first place, such as a salary spreadsheet in a site open to the whole company. Ordinary search needed the right keyword to find that file. An assistant answering 'what is the pay range for team leaders' can find it from a plain question.
Which reports show where the problems are?
In the SharePoint admin centre, the data access governance reports show where access is broadest. The site permissions report gives a snapshot across all SharePoint and OneDrive sites, including sites with thousands of users, external guests or 'Everyone except external users' permissions. The sharing links report shows the sites where people created the most links open to anyone, to everyone in the organisation or to specific people in the last 28 days. Another report lists the exact sites, folders and files shared through the special Everyone groups. Microsoft suggests running snapshot reports quarterly and activity reports monthly.
These reports sit within SharePoint Advanced Management, so check Microsoft's prerequisites for your licences. Microsoft notes that administrators with Microsoft 365 E5 can use data access governance reporting with limits: activity reports are available, while snapshot reports and remedial actions are not.
Which sites should you fix first?
Rank sites by what it would cost if the wrong person saw them. Human resources, payroll, finance, legal, board and executive sites come first, followed by sites holding customer or patient records. Within each, look for sites shared with everyone, folders with unique permissions that nobody remembers setting up, and old project sites with external guests. Ask each site owner to confirm who should have access, and record the decision. Sites with no identifiable owner need one assigned before anything else, because nobody else can say who should see them.
How do you fix access without breaking work?
Microsoft's remedial options include site access reviews, which ask site owners to review and update permissions, and restricted access control, which limits a site to a specific group. The change history report helps find recent permission changes that caused the exposure. Remove 'Everyone except external users' from sites that do not need it, replace organisation-wide links with links to named groups, and move sensitive files out of general team sites. Tell affected teams before you change access, because a broken link on a busy morning sends people looking for workarounds.
What if the review will take months?
Restricted Content Discovery hides selected SharePoint sites from organisation-wide search and Copilot while their permissions are reviewed. Microsoft describes it as a temporary control: it does not change permissions, people with access can still open the content directly, and it does not apply to OneDrive. Changes take time to spread through the index, and Microsoft says sites with more than 500,000 items can take over a week. It requires a Microsoft Copilot licence. For a custom knowledge search, the equivalent step is to leave those sites out of the indexing scope until they are fixed.
How do you test that it worked?
Create or borrow an account with ordinary staff access and ask the questions a curious employee might ask: pay rates, redundancies, disciplinary matters, bank details and board minutes. Every answer should come from a document that person is meant to see, or say nothing was found. Repeat the test after each batch of fixes. For a custom build, check that permission changes have reached the index. Microsoft notes that in Azure AI Search, source permission changes only appear in results after the next synchronisation, and some inherited SharePoint changes need an explicit refresh.