Microsoft Copilot can read more than your staff think — five SharePoint permission checks for Australian SMBs

Most Australian SMBs I talk to assume Microsoft 365 Copilot somehow “unlocks” SharePoint. It doesn’t. Graph-grounded Copilot surfaces content the signed-in user already has permission to see — so old oversharing (Anyone links, org-wide links, Everyone except external users, public Teams sites, broken inheritance) stops being buried and starts answering in plain English.

That’s a permissions problem that got loud, not a new access model. I help SMBs find the loud bits first. Paths match Microsoft Learn as of writing (~2026-09). Not legal advice.

This is not leftover guests, unused seats, or Copilot Studio publish checks — those are different screens. This one is SharePoint access Copilot can already see.

What Copilot does — and does not — change

Microsoft is clear: Copilot retrieves data from Microsoft Graph and respects existing permissions, sharing settings, and policies. Nobody sees anything in a Copilot answer they could not already open directly.

What changes is discoverability. Content that was technically reachable but practically buried — a folder shared years ago, a Team left Public, a link left on “Anyone” — becomes reachable through a normal question.

So the triage is simple: find oversharing, fix what you can in 15–20 minutes per check, and use discoverability controls only as a temporary brake while owners clean up.

SKU reality (read this before you open Reports)

Full Data Access Governance (DAG) reports, Restricted Content Discovery (RCD), and Restricted Access Control (RAC) sit under SharePoint Advanced Management (SAM).

Calm caveats I give every client:

• SAM is typically unlocked when at least one Microsoft 365 Copilot or Copilot Business seat is assigned in the tenant (the user doesn’t need to be a SharePoint admin).
• You can also buy the SharePoint Advanced Management Plan 1 add-on — Business Premium alone is not listed as a SAM Plan 1 base on Microsoft’s SAM prerequisites page.
• The first site-permissions / sharing snapshot can take up to about five days to populate. Subsequent runs are usually much faster (often within a day). Don’t start Copilot day-one and expect the report to be waiting.
• RCD is not a OneDrive setting — it applies to SharePoint sites. It is not a security boundary by itself. It reduces discoverability in organisation-wide search and Copilot; it does not revoke permissions.

If you don’t have SAM yet, you can still tighten tenant sharing defaults and review site membership manually — just expect more clicking and less CSV.

Where the reports live

1. Sign in to the SharePoint admin center as a SharePoint admin
2. Left pane → Reports → Data access governance
3. Start with snapshot reports (site permissions), then activity reports (sharing links, EEEU)

Kick off the site-permissions snapshot early in the week. Use the other four checks while it cooks if it’s your first run.

Check 1 — Anyone and People-in-your-organisation sharing links

Why it matters: An Anyone link is the classic “email this to a supplier and forget it” path. A People-in-your-organisation link is quieter and often worse for Copilot — every internal user who stumbles on (or is handed) that link can open the file, and Copilot can ground on it for anyone who already has access.

Find it (≈15–20 min):

1. SharePoint admin center → Reports → Data access governance
2. Under activity reports, open Sharing links
3. Review sites with the highest counts of Anyone and People in the organization links (last 28 days of activity on the activity report; the site-permissions snapshot also carries Anyone / People-in-your-org link counts)
4. Export or note the top offenders — Finance, HR, Board, and “Company documents” communication sites usually jump first

Triage rule:

Fix path (after the find): SharePoint admin center → Policies → Sharing — start at the top and tighten. Then ask site owners to retire stale links on the hot sites. Don’t delete links blind on payroll folders the week BAS is due.

Check 2 — Everyone except external users (EEEU)

Why it matters: EEEU is a built-in SharePoint group that means “every internal user in the tenant.” It is not “the Team.” It is not “the department.” If a library, folder, or file is shared with EEEU, Copilot can surface that content to staff who were never meant to know it existed — because they already have permission.

Find it (≈15–20 min):

1. Reports → Data access governance
2. Run / open Shared with ‘Everyone except external users’ (activity — last 28 days)
3. Cross-check the site-permissions snapshot for EEEU permission count on the same sites
4. Flag Public Microsoft 365 group–connected team sites while you’re there — Public privacy plus broad sharing is a double hit

Don’t confuse:

• EEEU ≠ leftover guests (different problem — guest inventory is Entra / Guest users)
• EEEU ≠ Everyone (Everyone can include guests — rarer, still worth a glance in the snapshot)
• System / classic publishing style libraries sometimes carry intentional Everyone access — Learn calls this out; don’t treat every hit as malice

Fix path: Remove EEEU from the item or library, replace with a real Entra / Microsoft 365 group, and tell the owner why. For high-risk sites that can’t wait, see Check 5 (RCD) as a temporary brake — then fix permissions.

Check 3 — Site membership sprawl (unique-user counts / nested groups)

Why it matters: Copilot risk scales with how many unique users can reach a site. Nested Entra groups make the real audience look small in the UI and large in the report. A “project Team” with three owners and a nested “All Staff” security group is an all-staff site.

Find it (≈15–20 min):

1. Reports → Data access governance → Site permissions across your organization (recommended snapshot)
2. When ready, open the SharePoint view — Learn surfaces the top sites by unique permissioned users
3. Download the CSV if you need more than the top 100
4. Sort by Number of users having access and scan Microsoft Entra group permission count
5. For a named VIP or leavers-risk user, use Site permissions for users once the org snapshot has run at least once

Triage rule: Sites with thousands of unique users, guest permission counts, or Entra group piles on HR / Finance / Board sites go to the front of the queue. Public team sites with no clear owner are next.

Fix path: Shrink membership to people who need the site. Expand nested groups in Entra and replace “All Company” nesting with a purpose-built group. Site access reviews (from DAG, where available) push owners to confirm — useful when IT shouldn’t be guessing who still needs access.

Check 4 — Broken inheritance / unique permissions

Why it matters: Broken inheritance is how one “quick share” on a single folder becomes a second permission universe inside an otherwise tidy site. Copilot still honours those unique permissions — so the overshare is real, just harder to see from the site home page.

Find it (≈15–20 min):

1. Same site-permissions snapshot as Check 3
2. In the download, use Items with unique permissions count — Learn describes this as the extent of broken inheritance
3. Pair high unique-permission counts with high unique-user counts and sensitive site names
4. Optionally open the site → Settings → Site permissions → Advanced permissions settings and look for “unique permissions” banners on libraries (manual spot-check when SAM isn’t ready yet)

Triage rule: A few unique items on a quiet site can wait. Hundreds of unique items on a payroll or board site cannot. Prefer restoring inheritance and re-sharing cleanly over forever-managing one-off ACLs — but restore inheritance only after you’ve mapped who would lose access.

Fix path: Inventory the unique items, decide which shares are still needed, restore inheritance where the one-offs were laziness, and replace legitimate exceptions with a dedicated library or a proper group. Don’t “reset” a client-delivery library on a Friday afternoon without telling the project lead.

Check 5 — Restricted Content Discovery (RCD) + sensitivity labels

Why it matters: Sometimes you need Copilot quieter on a site this week while owners clean permissions. Restricted Content Discovery is Microsoft’s per-site discoverability control for that gap. Prefer RCD over Restricted SharePoint Search (RSS) — RSS is retiring (new enablement blocked from 31 July 2026; full retirement 31 January 2027 on Microsoft’s announced timeline). Microsoft will not migrate RSS settings for you.

RCD find / apply (≈15–20 min for a shortlist):

1. Build your high-risk shortlist from Checks 1–4 (Anyone links + EEEU + sprawl + broken inheritance on sensitive sites)
2. SharePoint admin center → Sites → Active sites
3. Select the site → Settings tab → turn Restrict content from Microsoft Copilot on → Save
4. PowerShell equivalent (when you prefer script): Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true
5. Remember: RCD is SharePoint sites only — not OneDrive. Propagation can take time on large sites.

What RCD does not do:

• Does not change who can open the site if they navigate there directly
• Does not replace fixing permissions
• Is not a long-term substitute for least privilege
• Is not RSS — don’t plan a tenant-wide allow-list future on a retiring control

Sensitivity labels (EXTRACT) — secondary, not the hero of this post: Purview sensitivity labels still matter for encryption and policy. Where labels and Copilot rights (including EXTRACT-style rights for processing) are in play, treat them as part of content protection — not as a replacement for RCD or for cleaning EEEU and Anyone links. If labels aren’t rolled out in your tenant yet, don’t block the five checks on a labelling project.

Don’t confuse these with SharePoint oversharing

Suggested order for a busy SMB week

1. Kick off the site-permissions snapshot (expect up to ~5 days on first run)
2. Same day: Sharing links activity + tenant Policies → Sharing defaults
3. Same day or next: EEEU activity report
4. When the snapshot lands: unique-user sprawl + unique-permissions columns
5. Apply RCD only to the hot shortlist; diary a date to remove it after remediation
6. Tell owners in plain English what you found — Copilot didn’t create the access; it made it obvious

When a Security Health Check beats DIY

If you’ve got SAM, a Copilot rollout next quarter, and a SharePoint estate that grew through five years of “just share it with the company,” a fixed-scope Security Health Check is usually cheaper than discovering oversharing in a board chat. That’s one of the engagements I run for Australian SMBs: permissions shortlist, sharing defaults, and a plain-English remediation order — without a 60-page report.

Fifteen to twenty minutes per check gets you the map. The point is to stop Copilot reading the decade of oversharing your staff forgot they granted.