Oversharing in Microsoft 365 - What It Is and How to Fix It
Microsoft now uses the word 'oversharing' explicitly in its Copilot deployment documentation. It is the situation where content in your Microsoft 365 environment is accessible to more people than intended - not because of a security breach, but because of how permissions have accumulated over time. Copilot does not create oversharing. It makes oversharing consequential in a way it has never been before.
Why oversharing happens
Oversharing is not the result of negligence. It is the natural outcome of how Microsoft 365 is used over time. Permissions are added for good reasons - a project team needs access, a contractor needs to review a document, a new site is created and the default permissions are not adjusted. The problem is that permissions are rarely removed when the reason for them ends.
After three to five years of active use, a typical Microsoft 365 environment has permission state that nobody has fully reviewed and that does not reflect current organisational intent. Every organisation that has been on Microsoft 365 for more than two years almost certainly has oversharing somewhere. The question is where and how significant.
The five most common oversharing patterns
- 01
Everyone and Everyone except external users group access
When a SharePoint site or document library is shared with the 'Everyone' or 'Everyone except external users' built-in groups, every authenticated user in your tenant has access. This is sometimes done deliberately for intranet content, but frequently appears in project sites, team sites, and document repositories where it was never intended. With Copilot, this means a new employee on their first day can have content from these sites surfaced in their queries.
- 02
Broad Microsoft 365 Group and Team membership
Microsoft 365 Groups are the underlying membership structure for Teams. Every member of a Team has access to the associated SharePoint site and all its files. Teams created for large projects or company-wide purposes accumulate broad membership, and that membership grants SharePoint access that users may not realise they have - and that Copilot can query.
- 03
Unexpired sharing links
When a user shares a document via 'Share', they create a link that grants access to that file or folder. These links can be set to expire, but they frequently are not. An anonymous link created to share a document with a client exists indefinitely unless manually revoked. These links do not appear in site permission views - they are attached to the individual file and can only be seen by reviewing each file's sharing settings or through admin-level sharing reports.
- 04
Broken permission inheritance
SharePoint sites inherit permissions from their parent site by default. When a team manually grants access to a specific document or subfolder, SharePoint breaks inheritance and that item has its own separate permission set. Over time, an environment accumulates many items with broken inheritance, each with its own access list, making systematic permission reviews extremely difficult.
- 05
Retained external guest access
Contractors, clients, and partners invited to Teams channels or SharePoint sites remain as Entra ID guests until explicitly removed. The engagement may have ended, the person may have changed organisations, but their access persists. These accounts can be queried by Copilot from the guest's perspective - they retain whatever access they were granted.
How to find oversharing in your tenant
Microsoft has built several tools into the Microsoft 365 admin suite for identifying oversharing. None of them give you a complete picture in a single report - but together they cover the major patterns.
Where to look
- 1
SharePoint admin centre - Sites overview
Shows all SharePoint sites in your tenant with external sharing status. Filter for sites with 'Anyone' or 'New and existing guests' sharing enabled to identify your highest-exposure sites.
- 2
SharePoint admin centre - Sharing reports
Provides a report of recent external sharing activity. Shows what has been shared outside your organisation and with whom. Useful for identifying active external sharing patterns.
- 3
Microsoft Entra ID - Guest users
Lists all external guest accounts in your directory, when they were created, and their last sign-in. Accounts with no recent sign-in that were created more than 12 months ago are candidates for review and removal.
- 4
Microsoft Purview - Data access governance (preview)
Microsoft's newest tooling specifically addresses the Copilot oversharing problem. Includes reports on sites shared with Everyone, sites without active owners, and files with broad link access. Available in the Purview compliance portal.
- 5
SharePoint site permissions - site by site
For your highest-sensitivity sites, review permissions directly: Site settings → Site permissions. Check for Everyone group membership, large security groups, and any guest accounts.
How to fix it: a prioritised approach
Do not attempt to fix everything at once. Oversharing remediation on a mature tenant is a significant project if approached without prioritisation. The goal is to eliminate the highest-risk exposure first, then build governance processes that prevent recurrence.
- 01
Start with your most sensitive content
Identify the five to ten SharePoint sites containing your most sensitive information - financial data, HR records, board communications, client files, legal documents. Review and remediate those sites first. Remove Everyone group access, clean up stale members, assign ownership if sites are ownerless.
- 02
Remove or expire stale sharing links
Use sharing reports to identify broad external links. Revoke anonymous links that have no current business purpose. Set a default link expiry policy in SharePoint admin settings so future links expire automatically (30 or 90 days is a common choice).
- 03
Conduct a guest access review
Pull the guest list from Entra ID. For each guest account with no recent sign-in, confirm with the relevant internal contact whether access is still needed. Remove accounts where access is no longer required. Microsoft Entra ID Governance includes access review capabilities that automate this process.
- 04
Set default sharing settings for new sites
In SharePoint admin centre, configure the default sharing setting for new sites to 'Specific people' rather than 'Anyone'. This prevents new sites from inheriting the broadest sharing permissions by default.
- 05
Implement ongoing governance processes
Oversharing returns if the underlying process does not change. Implement site ownership requirements for any new SharePoint site. Configure periodic access reviews for external guests. Set link expiry policies. Schedule an annual permissions review across your most sensitive sites.
Remediating oversharing before Copilot deployment is significantly less disruptive than dealing with it after. Once users are actively using Copilot and content surfaces that was not expected, the response is reactive and often urgent. The same remediation work done proactively can be planned, prioritised, and communicated properly.
Next step
Copilot Readiness Assessment
The Copilot Readiness Assessment identifies oversharing patterns across your Microsoft 365 environment, prioritises remediation by risk, and ensures your environment is ready for Copilot deployment.
Learn more