Oversharing in SharePoint: who answers the site access review
Copilot doesn't create oversharing. It reads what people can already open, only faster. A folder shared with "Everyone except external users" three years ago, for a reason nobody remembers, is now one well-phrased prompt away from every employee. Microsoft's own data access governance documentation calls unresolved EEEU permissions a top oversharing risk for exactly that reason.
Finding that exposure is no longer the hard part. The SharePoint admin center will list it for you, down to the item. The hard part is deciding who fixes it, and on that Microsoft has made a clear design choice: the site owner does, with IT running the process around them.
Why IT doesn't do the review itself
Learn gives two reasons. Compliance rules usually keep IT administrators away from file-level and item-level detail, and site owners are better placed to know whether a permission is a mistake or a decision. So an admin starts a site access review from a data access governance report, and the request goes to the owner of each flagged site.
Know the mechanics before you promise a timeline. From the web view an admin can send reviews for up to 100 sites at a time; larger batches go through PowerShell, and the organization-wide site permissions report allows up to 1,000 reviews per calendar month. Each owner gets an email written for the specific finding: sharing links, content shared with EEEU, or the permissions baseline. The owner fixes what needs fixing through Manage access or the site's group membership, then selects Complete review and adds comments, which flow back to the admin. Until then the review sits at pending. If the owner's address is invalid, it fails.
Brief the owners before the first email lands
Two details decide whether owners act or ignore the request.
First, the numbers. The permissioned-user count on the review page isn't deduplicated. Learn's own example is a folder with 40 users from a group, 10 with direct permissions and 20 through sharing links, which reads as 80 even if the same people appear twice. An owner who sees 80 on a ten-person project folder will argue with the report instead of cleaning the folder. Tell them in advance what the figure means.
Second, the email itself. You can set the sender name, title, message and a link to your own instructions, and Learn notes this helps owners recognize a genuine request rather than a suspicious one. A governance email that looks like phishing gets deleted. Customization is saved per report type.
The controls around the review
Site access review is the durable fix, because the owner changes the permission. Three other controls sit around it, and each needs its own owner.
Restricted Content Discovery keeps a site out of organization-wide search and Copilot responses and removes Copilot entry points on that site, without changing anyone's permissions. Learn describes it as temporary and warns that heavy use thins out search and Copilot results. Propagation depends on size; for a site above 500,000 items it can take more than a week. We'd apply it to HR or finance sites while their owners review, with a removal date written next to each one.
Restricted access control limits a site to members of up to 10 Microsoft 365 or security groups, and search and Copilot honor it. Private and shared channel sites are separate site collections, so a policy on the parent team doesn't cover them.
Link expiration for "People in your organization" links reached general availability in March CY2026, per the Microsoft 365 roadmap. One behavior catches people out: existing links are judged against their original creation date when someone opens them. Switch the policy on and old links that teams still rely on can stop working that day. Announce it first.
A rhythm that has names on it
Learn suggests snapshot reports quarterly and the 28-day activity reports monthly. We'd attach an owner to each step:
| Step | When | Owner |
|---|---|---|
| Site permissions snapshot and the item-level EEEU report | Quarterly | SharePoint Advanced Management administrator |
| Sharing links and EEEU activity reports | Monthly | SharePoint administrator |
| Site access reviews, highest exposure first | After each run | Site owner completes; the data owner signs off for HR and finance sites |
| Restricted Content Discovery list | Monthly | Microsoft 365 service owner, removing entries as reviews close |
The item-level report needs the SharePoint Advanced Management Administrator role, which a Global Administrator assigns, because standard SharePoint admins can't see file properties across sites they don't own. All of these tools belong to SharePoint Advanced Management, which Microsoft makes available once a tenant assigns at least one Microsoft Copilot license, or through a separate add-on.
One roadmap item is worth watching. Microsoft lists a Governance Reviews Dashboard for site owners (roadmap ID 560541) as in development, with general availability stated as November CY2026. It gathers pending inactivity, ownership and attestation reviews into one place. It isn't available yet, so design the process without it.
Records people will recognize the principle. An access exception with no named owner never closes. It just gets older.
