Copilot Oversharing - Sites Open to the Whole Company

The question it answers: Which SharePoint sites grant Everyone, Everyone except external users or All users access, so Copilot can surface their content to every employee?

Microsoft 365 Copilot only shows people what they can already open - but it makes that content findable by asking a question. A site that grants Everyone, Everyone except external users or All users is readable by every employee, and Copilot will surface it. This scan checks each site’s own permissions and the members of its SharePoint groups. It does not see unique permissions on libraries, folders or files, or “People in your organization” sharing links.

Note

This is a SharePoint API permission (not Graph), used by PnP PowerShell with the app’s certificate - the same one the existing SharePoint reports use. The scan connects to every site once, so expect several minutes on a large tenant.

At a glance

Where in the app	SharePoint Online › Sites › Copilot Oversharing
Workload	SharePoint Online
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	None. SharePoint Advanced Management adds Microsoft’s own data access governance reports, which go deeper than this scan.
Report id (API and MCP)	sharepoint.sites.copilot-oversharing

Columns

Column	Key	Type
Site	Title	Link
Permissions	Url	Link
Exposure	Exposure	Status
Broad grants	BroadGrantsString	Text
Sensitivity label	SensitivityLabel	Text
External sharing	SharingCapability	Text
Template	Template	Text
Storage (GB)	StorageUsedGb	Text
Last modified	LastContentModified	Date

Filters

Filter	Key (API)	On when the page opens
Show only overshared sites and scan errors	problems	Yes

What it needs

Licence: None. SharePoint Advanced Management adds Microsoft’s own data access governance reports, which go deeper than this scan.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Sites.FullControl.All	Office 365 SharePoint Online	Have full control of all site collections

Data sources it reads

• PnP: Get-PnPTenantSite
• Get-PnPWeb -Includes RoleAssignments (per site)
• Get-PnPGroupMember (per SharePoint group)

Through the API and MCP

GET /ir-api/v1/reports/sharepoint.sites.copilot-oversharing?size=100
GET /ir-api/v1/reports/sharepoint.sites.copilot-oversharing?filter=problems
POST /ir-api/v1/reports/sharepoint.sites.copilot-oversharing/scan

An AI assistant reads it with the MCP tool get_report and the id sharepoint.sites.copilot-oversharing. The client needs the Run scan grant for SharePoint Online. See Using the API.