Label and review external sharing
A person checks a proposed sharing decision and its evidence.
Coming
See every demonstrationCOPILOT ACCESS REVIEW
Test what a cohort can reach before you add Copilot seats.
Adding Microsoft 365 Copilot seats without an access test carries an unexamined sharing risk into every answer. In two weeks we confirm the licensed scope, the access reports and a test cohort, review oversharing and the adoption prerequisites, and give you a go or no-go decision with the fix order and a named owner for each gap.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Confirm the licensed scope, the access reports and the test cohort; by the end of week one you hold the cohort access baseline with its data-source limits.
- Review oversharing on the sampled sites and the adoption prerequisites for the cohort.
- Write the readiness gap and owner register, one gap, one owner.
- Deliver the go or no-go decision with the fix order, reviewed by you before acceptance.
THE PROBLEM
What does a Copilot seat add that a license page does not say?
A search interface over everything that person can open, including the folders shared with everyone years ago. The seat is cheap to assign and expensive to explain when the first answer quotes a file the person should never have seen.
The review samples the sites the cohort uses, reads the access and usage reports, and separates the sharing that was tested from the sharing that was assumed, so the decision to widen rests on evidence about this cohort, not a tenant-wide guess.
THE MICROSOFT INSIGHT
What does Copilot return?
Only content the signed-in person already has at least view permission to see, so the cohort's access baseline is the exact boundary of what Copilot will surface for them.
Microsoft 365 Copilot returns only content the signed-in user already has at least view permission to see, so anything shared too widely is findable from day one. (Microsoft Learn, checked Oct 31, 2026)
Measure the baseline first and the gaps have owners before the seats land. Assign the seats first and the gaps are discovered one answer at a time.
THE METHOD
What happens in the two weeks?
A scoped baseline, a review, a register and a decision.
- Week 1: confirm licensed scope, access reports and the test cohort; by the end of the week the cohort access baseline exists with its data-source limits.
- Week 2: review oversharing and adoption prerequisites, write the readiness gap and owner register, and deliver the go or no-go decision with the fix order.
THE NEW REACH
Which report shows the widest shares first?
Since October 6, 2026 SharePoint Advanced Management reports item-level permissions granted to Everyone and to Everyone except external users, which the review reads for the sampled sites before anything else.
Since October 6, 2026 SharePoint Advanced Management reports item-level permissions granted to Everyone and to Everyone except external users. (Microsoft Learn, checked Nov 4, 2026)
Read the report and the broadest shares are the first rows of the fix order. Skip it and they are the first rows of the incident.
WHAT IT IS NOT
Does the review change permissions?
No. Tenant-wide enablement, file permission changes and promised adoption outcomes are out of scope. Your administrators perform any separately approved permission test, and the conclusion is bounded by the sampled sites and the licensed cohort. A site container label does not label the files.
Access is through named accounts in your tenant with the Reports Reader role for aggregate usage, the applicable Purview read roles and explicit access to the sampled sites; no tenant-wide write role is requested.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the cohort and content-access baseline with its data-source limits.
- You hold the readiness gap and owner register, one owner per gap.
- You hold a written go or no-go decision with the fix order.
- Your administrators keep every permission change; nothing was changed by us.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not keep a site out of answers while the fixes run. Restricted Content Discovery in SharePoint keeps a chosen site out of organization-wide search and Microsoft 365 Copilot answers while its permissions are reviewed, without changing who can open the files; Restricted SharePoint Search is retiring and new enablement has been blocked since July 31, 2026. (Microsoft Learn, checked Nov 1, 2026) Restricted Content Discovery can keep a reviewed site out of organization-wide search and Copilot answers without changing who can open the files, and the fix order says where to use it and when to lift it.
It does not enable Copilot for the tenant or change a permission; the fix order says what to change and who owns it.
It does not promise an adoption outcome; it says whether the cohort is ready and what blocks it.
THE ONE THING TO REMEMBER
Test access before adding seats.
Said another way: a cohort, a baseline, a register, a decision.
Said a third way: the seat costs the same either way; the explanation does not.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
How is the cohort chosen?
With you, from the people who will get the next seats and the sites they actually use. The conclusion is bounded by the sampled sites and the licensed cohort, and says so.
What access do you need?
Named accounts in your tenant with the Reports Reader role, the applicable Microsoft Purview read roles and explicit access to the sampled sites. No tenant-wide write role and no Global Administrator.
Does this help before an acquisition joins Copilot?
Yes. Testing inherited file access before acquired staff join a Copilot cohort is the same two weeks on their sites.
What is the difference from the Confidential Sites pilot?
This review decides whether a cohort is ready and what to fix first. The Confidential Sites pilot then decides label and access per site with the owners and tests the protections over four weeks.
How is it priced?
Quoted after a scoping call and fixed in a signed statement of work; Microsoft licenses and consumption are separate. The Microsoft Marketplace listing is pending; until it is live the engagement is quoted directly. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.