SharePoint Permissions Cleanup Before Microsoft 365 Copilot

SharePoint Permissions Cleanup Before Microsoft 365 Copilot: How to Reduce Oversharing and Data-Access Risk

By Michael Branson | August 22, 2026

Quick answer. SharePoint permissions cleanup before Copilot runs in five parts: inventory, sequencing, oversharing remediation, sharing link hygiene, and access reviews. Inventory and sequencing come first and produce the written link position; remediation and link hygiene then run as parallel streams under one consequence rank, and access reviews hold the result. Size that rank by sensitivity, exposure, and criticality rather than by traffic.

Four people hold pieces of this problem and nobody holds the whole of it: the SharePoint owner has the sites, the Microsoft 365 owner the tenant, the security lead the exposure question, the information governance lead the content. A Copilot sponsor behind them holds a date. The estate grew for a decade through migrations, reorganizations, project sites nobody closed, and invitations to people who have left. The question arriving with the date: who holds access to what, and who can show it from a record.

What This Page Owns, and What It Hands Off

This page owns the cleanup as work: what to inventory, which sites to take first, how to narrow access without stopping the business, what to do about old links, and what review holds the result.

It does not run the reports. Which report to open, what each returns, and how to act on a finding sit under the third gate of Is Your Microsoft Environment Ready for Copilot, which also carries the readiness decision.

Migration-triggered sequencing belongs to How to Migrate SharePoint to Microsoft 365 Without Breaking Permissions and Governance. Which content counts as sensitive is classification work, in Data Classification Before SharePoint Migration. The Purview classify, restrict, and monitor sequence sits in The Copilot Data Governance Fix. Conditional access and application consent are identity decisions, left to that layer.

Why Permission Debt Turns Into a Copilot Problem

The date is set. Somebody asks who still holds access to the legal matter workspace, and no answer comes from a record. Behind that silence is permission debt, the difference between the access an estate granted and the access its work needs today. Stale access is the visible balance, the grants that outlived the project that justified them.

Why that debt turns into exposure once Copilot is switched on is set out in The Copilot Data Governance Fix.

Pitched as a security project, permission debt competes with every other security project and stalls in the budget. Organizations with a standing compliance or identity budget are the carve-out, and there it is funded on the audit line. Outside it the sponsor funds an answer to one question: who still has access to the payroll site, the legal matter workspace, the board pack.

The Five-Part Cleanup Framework

Five parts carry the work, and the table has five rows, one per part. Inventory and sequencing run first and produce the positions the rest works under, the link position among them. Remediation and link hygiene then run as parallel streams against one consequence rank, and access reviews hold what they leave.

An inventory marking its own unknowns, with a named owner accepting the residual risk, is evidence for an auditor. A claim to have reviewed the whole estate is not.

Part One: Inventory the Estate

Inventory is a record, not a survey: a row per site somebody reads six months later without calling whoever built it. Each row carries an unknown column and this checklist:

• Site ownership: a named business owner and a named technical owner, both employed.
• Membership: which groups hold access, and how wide the widest one runs.
• Inheritance: where inheritance is broken, and whether anyone knows why.
• Sharing links: which exist here, of which type, issued when.
• Sensitive content: whether exposure here would be reportable, and who says so.
• External access: which guests hold access, against which project.

The reporting behind those answers carries gates and bounds, on Data access governance reports for SharePoint and OneDrive sites. Reaching it means signing in to the SharePoint admin center with SharePoint administrator credentials. Creating a report needs the prerequisites for SharePoint Advanced Management. Administrators with Microsoft 365 E5 licensing and no Advanced Management reach the reporting without the other Advanced Management features. At that tier the page documents activity reports capped at 10,000 sites, no snapshot reports, and no remedial actions.

Data access governance reports for SharePoint and OneDrive sites documents activity reports as tracking oversharing activity in the last 28 days, and adds that an organization without Advanced Management enables data collection first, after which reports hold data only from when collection was enabled. Read the window for what it evidences: sharing inside it, and nothing about grants before it. The same page names snapshot site permissions reporting as the baseline structure, so older grants come from that baseline where Advanced Management is in place, and otherwise out of the site record plus an owner attestation.

If the inventory is the part you have to fund internally, have that conversation early. Bring your site count, your reporting footing, and the enablement date. What comes back is a scoping document written for the committee that approves it: what it covers, what it will not reach, and the cost of leaving unknowns open. Two answers are worth naming in advance: that your cohort needs no remediation before its date, or that the constraint sits elsewhere, making this somebody else’s work.

Part Two: Sequencing, Which Sites Go First

Rank by consequence, which has three inputs: the sensitivity of the content, the breadth of its exposure, and the criticality of the site. Expected traffic is not one of them. A dormant site holding last year’s severance letters, open to four hundred people, outranks the busiest team site.

Build the rank from the inventory rather than opinion, and write the reason beside each position. The written link position comes out of the same pass, since part four cannot work a backlog against a rule nobody set.

No site this ranking calls high consequence gets scheduled after the date the estate turns Copilot on. The outcomes available are to remediate before the date, to move the date for that workload, or to apply a temporary compensating control. Plain deferral is not one.

That control reduces one surface and leaves the permission risk where it was, with its edges on Restrict discovery of SharePoint sites and content. The page describes limiting discovery of content from specific SharePoint sites in organization-wide search results and Copilot responses during review. Its stated bounds: site permissions stay the same, and users continue to access content they already have permission to access. It does not remove content from the search index, and it covers SharePoint sites rather than OneDrive. Its gate is the SharePoint Advanced Management prerequisites, including role-based access control role assignments, plus a Microsoft Copilot license, which is the license name the page states. The setting propagates across indexing systems, and how long that takes depends on site size and concurrent updates, with the page putting sites over 500,000 items at possibly more than a week. The page’s caution against excessive use is qualitative, with no numeric cap given: excessive use can reduce the content available to organization-wide search and Copilot experiences. The permission risk it leaves is recorded as residual, keeps its remediation date, and carries a named approver and a date it comes off.

Part Three: Oversharing Remediation

Remediation is narrowing, a business change wearing technical clothes. The target is least privilege, meaning an account holds the access its work requires and nothing beyond it. Closing the distance between that and a decade-old site takes away some access still in use. It also replaces paths rather than only subtracting: a narrower group for a wide one, an expiry for a standing link, an archive for a live site.

Consequence sets the order, and grant width is the tie-breaker between sites the rank scores level. A single external grant on regulated content outranks a wide internal group on low-sensitivity content, because the first can carry reportability or contractual exposure and the second untidiness. Inside a band, take the widest grants before the broken inheritance beneath them, since each closure retires more exposure per change. A department group on a department site is correct when the group matches the site’s content and work purpose, and advice to strip all broad access is where these programs lose their mandate.

Three rules keep the program alive past its second week. Nothing is removed without the site owner in the change, because the owner knows what the access was doing. Each change carries a rollback position written before it is applied. An exception is allowed, with a name and an end date, because a program with no exception path gets routed around.

Part Four: Sharing Link Hygiene

Links are the part of the estate nobody inventoried. They are a separate path to content from group membership, and they outlive the conversation behind them. Link type decides behavior, and the differences are documented on How shareable links work in OneDrive and SharePoint in Microsoft 365. Anyone links give access to the item to anyone who has the link, and the page states that people using one do not have to authenticate and that their access cannot be audited. People in your organization links work only for people inside the organization, not for guests, and the recipient authenticates as a member. Specific people links work only for the people the sender specified, and the same page records that they make the file appear in search results and accessible through Copilot for the users and security group members added to them.

Manage sharing settings for SharePoint and OneDrive in Microsoft 365 sets out what the tenant controls. Its most permissive option, Anyone, allows sharing by links that anyone holding the link opens without authenticating. Where it is selected, the page documents restricting those links so they must expire within a specific number of days, or so they give only View permission. Settings are for the organization overall, with each site at the same or a more restrictive level. The page bounds how far a settings change reaches links already issued, twice. The file and folder link settings specify the options shown by default when a user creates a link. On expiration, changing the expiration time leaves existing links at their current expiration when the new setting is longer, and updates them when it is shorter. Past that rule the page describes settings governing link creation, so links already issued are inventoried and revoked or changed as separate work.

The position comes out of sequencing: which link types you issue, at which level, with which expiry, dated. The backlog issued under the old position is counted from the site permission record rather than the activity window, and ranked with the group grants.

Where the link position is contested internally, an outside read settles it faster than a fourth meeting. Bring the links you can enumerate, your settings, and the date. Your sharing model is in shape when the position carries a date, the older-link inventory sits beside the window-bounded count, and exceptions carry names and end dates. The work is somebody else’s when the contested question is classification or identity.

Part Five: Access Reviews

The first four parts produce a baseline rather than a finished estate: a dated record of who reaches what, the unknowns named inside it, the exceptions carrying owners and end dates. Residual risk lives there, recorded rather than closed. Access reviews stop the baseline drifting.

Create an access review of groups and applications in Microsoft Entra ID documents the instrument. Using it requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses, and the review is created by an administrator signed in with at least the Identity Governance Administrator role. The page’s note on nested groups is a scoping trap. It states that in a group review, nested groups are automatically flattened, so users from nested groups appear as individual users. It continues that a user flagged for removal because of nested group membership is not automatically removed from the nested group, but only from direct group membership. A reviewer approving that removal closes a path the user did not hold and leaves the nested path open. So the nested groups go into the review scope by name, and the applied result is checked against the membership record. Before a nested-group removal counts as enforceable, check who owns the group, whether it is dynamic or synced from on-premises, and what else it grants; a group failing that check gets its own owner and its own decision.

That reach bounds the plan. The page documents reviews of group members and application access. It does not describe recertifying SharePoint groups, direct or unique permissions on a site, sharing links, or site collection administrators. Business paths there are recertified by the site owner, from the site record and the remediation change log, on the same cadence. Privileged and tenant-controlled paths, site collection administrators, admin role assignments, and externally managed groups, are validated by the SharePoint and Microsoft 365 administrators. A program that schedules Entra reviews and calls the estate recertified has covered the identity paths only.

Reviewer choice decides whether a review produces anything. Routed to central IT the cycle drifts toward approval, because that reviewer rarely has the basis for saying no. Routed to site owners it produces more removals.

Two design choices belong in the schedule. The rule for silence: a non-responding reviewer produces a default written in advance, and that page’s completion settings carry the choice. The applied-changes check: a cycle is complete when the decision record and the membership record agree the reviewed access path was removed, whether a group membership, an app assignment, a site grant, or a link grant.

Common Failure Modes

The stalls repeat, each with an early tell.

A one-time sweep treated as governance. It produces a baseline that week and a drifting one by the next quarter. Look for a remediation task with no cadence behind it, or an inventory with no unknown column.

Technical fixes applied without the owner. Access gets revoked, work breaks, an executive escalates, and the program loses the authority it needed for the sites that mattered. The giveaway is a plan with no sign-off column.

Inheritance chased while links and groups go untouched. Broken inheritance is visible and satisfying to fix, while wider exposure sits in link volume and group width. Watch for a status report counting unique permissions with no line for either.

New sites arriving faster than the cleanup closes old ones. The standing fix is provisioning-time policy, described in SharePoint Site Provisioning Governance. The clue is a site count that grew during the cleanup.

How i3solutions Runs the Cleanup

The work runs as a project with an owner, a rank, and a written recommendation. Discovery comes first, against your estate rather than a questionnaire: what your reporting returns, what it leaves unknown, which sites carry consequence. Remediation then runs in waves with the site owners in the room, each carrying its change log, rollback position, and exceptions with end dates. The recurring review is designed in the same pass, because a cadence retrofitted after launch rarely survives its second cycle.

The recommendation carries one of three verdicts: permissions already in shape for the rollout you have in mind, a scoped program with a sequence and a date, or a blocker sitting somewhere other than permissions.

Governance-adjacent delivery sits beside this work rather than permissions cleanup. It includes workflow automation with approvals the client can audit to meet regulatory requirements, for a regional healthcare system, and SharePoint consolidation into a unified Office 365 environment with identity integration for a nonprofit government consulting firm. i3solutions has been a Microsoft partner since 1997 and has delivered 600+ Microsoft platform implementations. What that buys you is borrowed expertise: pattern recognition from estates carrying the same debt. The record sits at Transforming Onboarding with Workflow Automation and a Unified Office 365 Environment.

When i3solutions Is Not the Right Next Call

Whether governed Copilot enablement is your next step at all is covered in Secure Copilot Enablement vs Turn It On: The Enterprise AI Risk Comparison. Three further situations belong elsewhere.

A migration in flight. The sequencing call is different, and the migration governance page linked above answers it.

A classification problem wearing a permissions costume. Where the open question is which content is sensitive, group narrowing does not answer it.

A decided plan that needs hands. Where the rank exists and you need execution capacity, that is a staffing conversation.

What is left is the case this page was written for: an estate nobody has audited, a date somebody has committed, and a room that cannot answer the access question from a record. Bring the inventory you have, however partial, your reporting footing, and the enablement date. An hour against those three settles whether permissions are the constraint. The endings are unchanged: your permissions are in shape for what you plan to turn on, or there is a scoped program with a rank and a date, or i3solutions saying this is not our work. Contact a senior SharePoint architect

Frequently Asked Questions

How do we clean up SharePoint permissions before enabling Copilot?

How to prepare SharePoint permissions for Copilot comes down to five parts. Inventory the estate into a record that marks its own unknowns, then sequence the sites by sensitivity, exposure, and business criticality rather than by traffic. Sequencing also produces the written link position. Oversharing remediation and sharing link hygiene then run as parallel streams against that one rank: narrow the grants with the site owner present and a rollback written first, and work the link backlog under the position. Put a recurring access review behind the result, routed to site owners rather than to central IT, with a written rule for reviewers who stay silent. Anything the ranking calls high consequence gets a date before enablement, a temporary discovery restriction whose approver and lift date are named, or a moved date. Deferring it past the enablement date is not one of the outcomes this page recognizes.

How do we find oversharing in SharePoint?

Start from the tenant reporting available to you, then read what it leaves out. Microsoft documents on Data access governance reports for SharePoint and OneDrive sites that data access governance reporting is reached by a SharePoint administrator, and that creating a report needs the SharePoint Advanced Management prerequisites, set out on Prerequisites for SharePoint Advanced Management. Administrators with Microsoft 365 E5 licensing and no Advanced Management reach the reporting without the other Advanced Management features. At that tier the same documentation, Data access governance reports for SharePoint and OneDrive sites, states that activity reports return up to 10,000 sites covering the last 28 days, with no snapshot reports and no remedial actions. So the window evidences recent sharing and nothing before it. Where Advanced Management is in place, older grants come from the snapshot permission baseline. Without it there is no snapshot report to run, and the older grants sit in the site record, with a written owner attestation beside them.

What is the fastest way to remediate SharePoint permission sprawl?

Speed comes from the order, not from the tooling. Rank by consequence, using sensitivity, exposure, and criticality, and use grant width only to break ties between sites the rank scores level. A single external grant on regulated content goes before a wide internal group on low-sensitivity content. Within a band, close the widest grants first, because each retires more exposure per change than the intricate cases underneath, and take broken inheritance second since each instance needs its original reason recovered. Run the changes in waves with the site owner present, and give every wave a rollback position and an exception path with end dates.

Do sharing links break Copilot readiness?

That depends on the link types in your estate and on what your written position says about them. Microsoft documents three primary types. A specific people link works only for the people named on it, and the same documentation states that it makes the file appear in search results and accessible through Copilot for those people. A people in your organization link works only for authenticated members, not for guests. An Anyone link opens for whoever holds the URL, without authentication, and Microsoft states that access through it cannot be audited. Uncontrolled Anyone links on sensitive content are a readiness problem by this page’s own model, and links belong in the same inventory and the same consequence rank as group grants.

How do we explain permission debt to the business?

Take one site, not a statistic. A sponsor funds an answer to a specific question, such as who still has access to the payroll site or the board pack. The current answer usually ends the debate about whether the work is real. Frame the ask as accountability rather than as a security project: named owners, a record saying who reaches what, and a review that removes access when a role changes. The objection that follows is that cleanup breaks work in flight, and the answer to it is the rollback position and the dated exception path already in the plan.

Related Reading

• Microsoft 365 Access and Permissions, the general governance frame this cleanup sits inside
• Enterprise SharePoint Development Services, the delivery practice behind the remediation work
• SharePoint Content Management Consulting, what to do about the content once the access question is settled

About the Author

Michael Branson co-founded i3solutions and brings executive, operational, and technical perspective to organizations whose Microsoft estates carry regulated content, audit obligations, and uptime the business depends on. He works with enterprise teams on the governance decisions that determine whether a platform investment holds its value.