Copilot is showing old SharePoint access, not creating new leaks
Reviewed by Helen Jones
Microsoft 365 Copilot still only returns files a user already has permission to open. What changed is visibility. Broad Everyone except external users grants, broken inheritance, and unexpired anonymous sharing links now turn up in ordinary questions instead of staying buried in libraries. Petri’s analysis, last updated 15 September 2026, points to Microsoft’s Copilot oversharing blueprint, which splits the work into Pilot, Deploy, and Operate using SharePoint Admin Center, SharePoint Advanced Management, and Microsoft Purview. Copilot does not grant new access. SharePoint Advanced Management is now included if even one user has a Microsoft Copilot licence, or via the Plan 1 add-on on qualifying SharePoint K, P1, or P2 subscriptions. Tenants get a Content Management Assessment that flags oversharing, EEEU usage, broken inheritance, and ownerless sites. Concentric AI’s review of more than 550 million records found 16 percent of business-critical data overshared, about 802,000 files at risk on average per organisation.
Before Copilot, oversharing lived in admin reports and ticket queues. Users only found what they browsed to, so Everyone except external users and leftover guest links could sit for years without anyone noticing. Copilot readiness was treated as a licence and prompt problem. After Copilot, the same grants become answers. The useful shift is licensing, not theory. One Copilot seat now brings SAM’s assessment into the tenant, so the first Copilot pilot is also a permissions inventory. File-level reports still need the right SAM admin role, so the bottleneck is cleanup capacity, not a new Microsoft leak.
Analysis
This is a change to act on before a wider Copilot rollout, not a reason to freeze Copilot. Open the Content Management Assessment and work the EEEU and ownerless-site lists first, then expire anonymous links. Leave a full inheritance rewrite until those two buckets shrink.
Source note
Pulse published by Collab365 Spaces, reviewed by Helen Jones on . Cite as "Copilot is showing old SharePoint access, not creating new leaks", Collab365 Spaces. 3 sources referenced.