Oversharing Remediation Clearing the Path for Copilot at a 2,900-employee Professional Services Firm
A Copilot pilot surfaced partner compensation and a live deal room to people who should never have found them — an access fault, not a Copilot fault. We scanned 3,100 sites, removed org-wide access from 410, and reached general availability in 9 weeks.
About the Client
The Challenge
The firm bought Copilot licences for a pilot group and had a problem within the first week. A consultant asked about partner compensation and got an answer, sourced from a spreadsheet on a site shared with everyone in the organisation years earlier and forgotten. A second user found material from a live transaction their engagement team was supposed to be walled off from.
Neither was a Copilot defect. Copilot answers from the Microsoft Graph and honours existing permissions — it shows nobody anything they could not already open. The difference is that nobody was ever going to find that spreadsheet by browsing, and the semantic index finds it in under a second. Fifteen years of accumulated access decisions became visible in a week.
The mechanism was org-wide access. Sites created from certain templates, and sites where someone chose the broadest option in a sharing dialogue, carried access for every internal user. Alongside that sat years of company-wide sharing links, guest accounts on engagements closed long ago, and sites whose owners had left, leaving nobody with standing to review anything.
Professional services makes this worse than most. Client engagement material is confidential by contract, not just by policy, and conflicts management depends on teams genuinely not seeing each other's work. The managing partner was firm: the pilot would not expand until someone could state, with evidence, what the internal access surface was.
Our Approach
Copilot readiness is an access hygiene programme with a deadline. The work is not making Copilot behave differently — it is finding what your users can already reach, and deciding which of that was ever intended.
Measure the Access Surface (Weeks 1-3)
Enabled SharePoint Advanced Management and ran the data access governance reports across 3,100 sites: sharing links by type, content shared with everyone except external users, sites with the broadest internal permissions, permissioned user counts, and label coverage. Worth settling first, because plans regularly assume otherwise — SharePoint Advanced Management is not part of E5. The oversharing features arrive once at least one Copilot licence is assigned in the tenant, or through a separate add-on. These reports are the only practical way to see the org-wide access surface at tenant scale, and the first output is usually a number nobody believes. We also pulled ownerless and inactive sites, since a site with no owner can only be remediated by an administrator.
Restricted Content Discovery as a Deliberate Stopgap (Weeks 2-5)
Remediation takes months and the pilot was running now, so we restricted reach while cleanup proceeded. Restricted Content Discovery, a SharePoint Advanced Management control, was applied per site to the highest-risk material: flagged content stops surfacing in Copilot and organisation-wide search while staying accessible to those who work in it. We did not build on Restricted SharePoint Search, the tenant-wide allow list of up to 100 sites earlier readiness plans reached for. It was never a security boundary, it does not guarantee that only allow-listed sites appear, and new enablement is blocked from 31 July 2026. The per-site control is the successor. Either way we were explicit with the sponsor: containment with a removal date, not an architecture. A permanently restricted Copilot is one people stop using.
Site Access Reviews Delegated to Owners (Weeks 4-12)
Central IT cannot decide who should reach an engagement site. The oversharing reports were converted into site access reviews and sent to owners, who see their own site's exposure and act on it — removing org-wide access, revoking links, pruning guests. 380 reviews went out in waves by practice group with a partner sponsor behind each. 260 ownerless sites were handled through an ownership policy that assigns a new owner or archives the site.
Labels, DLP for Copilot and Information Barriers (Weeks 8-16)
Access cleanup removes most of the risk; classification handles the rest. Sensitivity labels were applied to the categories that must never be summarised, and because Copilot honours the extract right, content protected by a label withholding extraction is not used in responses. Data loss prevention policies scoped to the Microsoft 365 Copilot location excluded further categories. That location takes only the custom template, and the condition withholding content from processing is a sensitivity label — sensitive information types are not available there as a content condition. The DLP layer therefore rests on the labelling done in the step before it, and affected items still appear in citations with their content withheld. Information barriers were configured to keep conflicted engagement teams apart, which matters more once an assistant does the searching, building on the firm's existing information protection taxonomy.
Release, Audit and Steady State (Weeks 15-20)
Copilot went to general availability for 150 users once the access reports were clean enough to show the partnership. Prompts and responses are captured in the audit log and discoverable, so the eDiscovery and audit teams were briefed on where that content lives before release rather than after. Oversharing reports now run on a schedule, site access reviews recur, and Restricted Content Discovery is lifted site by site as each one is cleared.
Solution Architecture
Assessment: SharePoint Advanced Management data access governance reports for sharing links, org-wide access, permissioned users and label coverage, plus ownerless and inactive sites
Containment: Per-site Restricted Content Discovery in SharePoint Advanced Management, with explicit removal criteria — not the retiring tenant-wide allow list
Remediation: Site access reviews delegated to owners, ownerless site policy, guest access expiry, default link type set to specific people
Classification: Sensitivity labels withholding extraction on the highest tier and DLP policies scoped to Copilot to exclude further categories
Separation: Information barriers enforcing conflict walls between engagement teams, applied to Copilot retrieval as well as chat and file access
Results
Client identity withheld under confidentiality. Figures are representative of engagements of this scope.
Technologies Used
Key Takeaways
If your organization is facing a similar challenge, here's what we learned:
Copilot does not create an oversharing problem. It reports one. Every answer comes from content the user could already open. What changes is the effort to find it — from browsing a site nobody remembers to asking a question in plain language.
Org-wide access is the single biggest source of surprise. It gets applied by default in some provisioning paths and by a careless click in others, and never reviewed because nothing surfaces it. The oversharing reports find more of it than anyone expects.
Restricted Content Discovery buys time; it does not buy a solution. Limiting what Copilot reaches is right while cleanup runs and wrong permanently. Set the removal criteria when you set the restriction. And do not plan around Restricted SharePoint Search — new enablement is blocked from 31 July 2026, and it was never a security boundary.
Only site owners can judge site access. Central IT produces the report but cannot decide whether an engagement team should see a folder. Delegated reviews with a partner sponsor behind each wave are what move the numbers.
Brief the eDiscovery team before you release, not after. Copilot prompts and responses are retained and discoverable. The time to think about that is during planning, not during a document request.
Related Case Studies
Do You Know What Your Users Can Already Reach?
Copilot will find out for you, in front of an audience. We measure the access surface, drive owner-led remediation, and get the rollout released with evidence behind it.