Overshared SharePoint: Why “Everyone Has Access” Is Your Biggest Copilot Risk

When clients ask me where to start with Microsoft 365 Copilot security, my answer is always the same: SharePoint. Not because SharePoint is insecure. Microsoft gives you strong controls. The risk comes from how SharePoint has actually been used for years: sites with no owner, folders shared with “everyone” because it was quicker, and guests who never left.

Before Copilot, all of that was protected by obscurity. Nobody went digging through 40,000 old documents. Copilot removes the obscurity. If a user can open a file, Copilot can read it, summarise it and quote it back in seconds. That is why overshared SharePoint is the biggest Copilot risk in most tenants.

How “everyone has access” happens

Oversharing is almost never one bad decision. It is hundreds of small, reasonable-looking shortcuts that add up:

• Sites without owners. A project site is created, the project ends, and nobody reviews who still has access.
• Convenience sharing. A folder is shared with a whole department, or with “Everyone except external users”, because it’s faster than working out who needs it.
• Inheritance nobody understands. Permissions set at the top of a site cascade through libraries and folders, with unique permissions sprinkled on top, until nobody can explain the result.
• Guests who stay forever. External users are added for one deliverable and are still there three years later.
• Leavers and movers. People change roles but keep the access they had in their old team.

Ask anyone in the organisation to describe the access map accurately and they can’t. That is the hidden cost: not one breach, but a slow build-up of access that silently expands what Copilot can surface.

Why Copilot turns access into exposure

Copilot doesn’t break permissions. It respects them exactly. That is precisely the issue. The chain looks like this:

1. Access equals visibility. If a user can technically open a file, Copilot can read it.
2. Visibility equals exposure. Once Copilot can read it, it can surface it in an answer.
3. Exposure equals risk. Something one person might have stumbled on by accident becomes something a whole department can find with one question.

The content that typically leaks this way is exactly what you’d expect: salary and performance data, disciplinary records, board papers, M&A discussions, commercial contracts and customer data.

How to find overshared content

You need a tenant-wide view, not just the sites people remember. Look for:

• Sites and libraries shared with Everyone or Everyone except external users.
• Files with “anyone” or organisation-wide sharing links.
• Sites with no active owner, or owners who have left.
• Libraries with broken inheritance and large numbers of unique permissions.
• Guest users who haven’t signed in for months.
• Libraries holding sensitive content (HR, finance, legal) with broad access.

If you have SharePoint Advanced Management, its data access governance reports and site access reviews are a good starting point. For a quick PowerShell audit of guests, see extract SharePoint external users with PowerShell. The screenshots below come from LogiSam’s Copilot SafeScan, which brings these checks together in one report.

How to fix it without stopping collaboration

The goal isn’t to lock SharePoint down. Teams still need to share quickly. The goal is that access reflects who needs it, not who was added at some point and never removed.

Quick wins (first two weeks)

• Remove “Everyone” and “Everyone except external users” from sensitive sites and libraries.
• Change the default sharing link to “Specific people” rather than “People in your organisation”.
• Remove or expire stale guest accounts.
• Assign an owner to every active site, and archive sites that no longer have a purpose.

Structural fixes (next quarter)

• Run site access reviews with site owners, so the people who understand the content confirm who should have it.
• Apply sensitivity labels to HR, finance and legal content.
• Use Restricted Content Discovery or restricted access controls for high-risk sites while you clean them up, so Copilot doesn’t surface them in the meantime.
• Simplify inheritance: fewer unique permissions, and more access through Microsoft 365 groups.

Permissions are now a security control

In a Copilot-enabled organisation, every access grant is a decision about what the AI is allowed to surface. Permission design stops being a background IT chore and becomes a frontline security control. Treat it that way before you assign Copilot licences, not after the first awkward incident.

Oversharing is half of Copilot readiness. The other half is content quality, which I cover in why Copilot gives wrong answers. For the full list of technical prerequisites, see Before you turn on Copilot.

FAQ

Does Copilot ignore SharePoint permissions?

No. Copilot only uses content the signed-in user already has permission to access. The risk is that users have far more access than anyone realises.

Should we delay Copilot until permissions are perfect?

No. Fix the highest-risk sites first, restrict discovery of sensitive sites temporarily, and roll out in waves while the wider clean-up continues.

What is “Everyone except external users”?

It’s a built-in claim that includes every internal account in your tenant. Granting it access to a site makes that site’s content available to the whole organisation, and therefore to Copilot for every user.