Auditing Copilot Oversharing: A Read-Only SharePoint Access Report
1. Study log: investigate the grant, not the headline
Microsoft describes the “Everyone except external users” group as including internal users and excluding external guests, and offers reports for recent EEEU sharing activity.[3] This group grant can be a reason to investigate scope—not proof that a data leak occurred.[unverified] A site permission snapshot helps identify broad user access; the separate activity report covers sharing signals in its documented recent period.[3]
This is a reproducible lab plan, not a report from my tenant. I did not connect to Microsoft 365, generate a report, inspect anyone’s files, or change permissions. All sample rows and identifiers below are synthetic.
| Dimension | Default response | AI-hardened / evidence-led response |
|---|---|---|
| Signal | Treat a broad group name as a finding | Treat it as a triage signal; validate site, item, audience, and purpose |
| Discovery | Ask site owners to search manually | Generate a permission snapshot and a recent-activity report for a defined question |
| Interpretation | Assume a report means confirmed exposure | Check report type, time window, scope, access path, sensitivity, and business context |
| Remediation | Remove access quickly across many sites | Route specific findings to accountable owners; require approval and a separate change plan |
| AI use | Paste a raw CSV into a public assistant | Minimize and redact data; use only approved tools and data-handling controls |
Microsoft states that Copilot uses existing Microsoft 365 permissions. Oversharing can therefore matter to Copilot discovery, but report findings need context before a risk decision.[1][3]
2. Lab architecture and prerequisites
Flow: approved administrator workstation → SharePoint Online PowerShell → SharePoint DAG report service → report status and CSV export → local, access-controlled review folder → site owner / security reviewer.
Keep this lab read-only. Start-SPODataAccessGovernanceInsight, Get-SPODataAccessGovernanceInsight, and Export-SPODataAccessGovernanceInsight generate, track, and export reports; they do not remove permissions. The DAG PowerShell workflow requires Microsoft.Online.SharePoint.PowerShell version 16.0.25409 or later and the supported modern sign-in flow. Connect without the -Credential parameter.[5]
For recent-activity reports, Microsoft says organizations without a SharePoint Advanced Management (SAM) license must enable audit-data collection first.[5] Reports become available after 24 hours, contain data from when collection began, and retain 28 days of activity; collection can pause if reports are not generated for three months.[5] Do not enable collection as an incidental script side effect—confirm licensing, privacy review, and change approval first. The activity-report prerequisites are also summarized on Microsoft’s DAG overview.[3]
The SharePoint Advanced Management prerequisites describe eligible base subscriptions and Copilot or standalone add-on access paths; some advanced features require the add-on.[4] Verify the current tenant entitlement and least-privilege administrator role before running the exercise.[4]
3. Implementation: a named, repeatable report run
- Use a disposable lab tenant or an explicitly approved production read-only session. Do not use a global administrator when a narrower SharePoint role suffices.
- Confirm the module version and endpoint, report purpose, workload, data-retention location, and approver. Never place tenant credentials in a script or transcript.
- Create a current-state permission snapshot. Keep the report name stable for traceability but unique per planned run.
- If recent-activity data collection is a prerequisite, request separate approval and follow Microsoft’s documented enablement steps. Do not silently turn it on.
- Poll the report by its returned ID. Export only after status is
Completed; record report type and time window beside the CSV. - Review a minimized copy with the site owner and security reviewer. Keep any remediation in a separately approved, tested change—not in this inventory script.
Microsoft documents the site permission snapshot and EEEU site/item activity report parameters below.[5] The example calls are intentionally shown as separate, explicit operations; they are not run here.
# Synthetic lab plan only — requires approved SharePoint Online PowerShell setup.
# Connect-SPOService -Url $AdminUrl # modern interactive sign-in; no -Credential
$runName = 'AB90002-SyntheticLab-PermissionSnapshot'
$report = Start-SPODataAccessGovernanceInsight `
-ReportEntity PermissionedUsers `
-ReportType Snapshot `
-Workload SharePoint `
-CountOfUsersMoreThan 0 `
-Name $runName
# Store the returned ReportId in the run record; query status before export.
# Get-SPODataAccessGovernanceInsight -ReportID $report.ReportId
# Export-SPODataAccessGovernanceInsight -ReportID $report.ReportId `
# -DownloadPath $ApprovedReportFolderFor targeted EEEU signals, use the documented EveryoneExceptExternalUsersAtSite or EveryoneExceptExternalUsersForItems activity report entities. Microsoft’s recent-activity report describes activity in the preceding 28 days, subject to collection prerequisites.[5]
# Explicitly separate activity report request; not executed.
# Start-SPODataAccessGovernanceInsight `
# -ReportEntity EveryoneExceptExternalUsersForItems `
# -Workload SharePoint `
# -ReportType RecentActivity `
# -Name 'AB90002-SyntheticLab-EEEU-Items'Deliverable: synthetic triage CSV contract
The production report CSV is generated by Microsoft. This separate review contract describes a safe, minimized working copy; it is not a Microsoft schema and contains no actual tenant data.
| Column | Purpose | Example (synthetic) |
|---|---|---|
ReportId | Link row to generated report | 00000000-0000-0000-0000-000000000002 |
ReportType | Distinguish snapshot vs. recent activity | RecentActivity |
Workload | Keep SharePoint / OneDrive scope explicit | SharePoint |
SiteId | Stable site reference in restricted working copy | SYNTHETIC-SITE-02 |
AccessSignal | Short report finding category | EEEU-item-sharing |
ObservedWindow | Report start/end or snapshot date | Synthetic 28-day window |
OwnerReview | Human triage state | Pending |
Decision | Approved next step, if any | Not assessed |
Do not put file contents, personal identifiers, or sensitive document titles in this derived triage file unless an approved process requires them. Store the source CSV with restricted access and a documented retention period.
4. Safe verification and rollback boundaries
This workflow does not alter SharePoint permissions, so there is no tenant-side rollback action to perform. Stop and escalate if the module version is unsupported, the report workload/time window is unclear, data collection is not authorized, the export path is outside the approved location, or a report status is not complete.
For each candidate row, verify: report ID; report type; workload; generated time/window; site or item scope; permission path; intended audience; data sensitivity; business owner; and whether the grant remains necessary. Preserve the untouched source export separately from the minimized review copy. If a later approved remediation changes access, record its change owner, approval, target set, expected impact, validation, and rollback plan in that change record—not in this read-only report script.
A DAG report is a discovery aid, not a certification of exposure or proof that Copilot returned data to an unintended user. Microsoft describes snapshot reports as a point-in-time view and recent-activity reports as activity signals, each with a documented window.[3][5]
5. AB-900 public-objective alignment
The official AB-900 study guide names objectives covering SharePoint oversharing, its troubleshooting tools, data access governance reports, and SharePoint Advanced Management, including restricted access control.[1] This episode practices judgment around permissions and governance evidence.
Blueprint transition: Microsoft’s official certification page says the English version updates on October 14, 2026. The study guide currently exposes the objectives “as of October 14, 2026,” with domains: Microsoft 365 core features/objects 30–35%; data protection and governance 35–40%; Copilot/agent administration 25–30%.[1][2] Use those upcoming weights for a review scheduled after that effective date; do not blend them with the previous blueprint. The official page does not state a prior-version valid-through date in the material retrieved for this article.[1][2]
6. Next step in the study journey
Next, I’ll move from permissions evidence to Purview signals: classification, sensitivity labels, and governance workflow. Before running any report, check the current official AB-900 guide and the tenant’s specific licensing and role requirements.[1][4]
Related ZakitPro reading: AB-900 Day One: A Safe Conditional Access and Intune Lab Blueprint for Copilot.
Sources
[1] https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-900 — AB-900 study guide [2] https://learn.microsoft.com/en-us/credentials/certifications/copilot-and-agent-administration-fundamentals — AB-900 certification [3] https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports — Data access governance reports for SharePoint and OneDrive sites [4] https://learn.microsoft.com/en-us/sharepoint/sharepoint-advanced-management-prerequisites — Prerequisites for SharePoint Advanced Management [5] https://learn.microsoft.com/en-us/sharepoint/powershell-for-data-access-governance — Manage Data access governance reports using SharePoint Online PowerShell