SharePoint, Teams and OneDrive
governance and oversharing, reviewed.
We review who can see and share what in SharePoint, Teams and OneDrive, using reports and settings you choose to share, and give you a written report of oversharing, guest, ownership and labelling gaps, ranked by what to fix first.
Who it is for
Organisations whose SharePoint and Teams have grown without much governance, that use guest access, or that plan to use Copilot and want to know what it could surface.
What we review
- Organisation-level sharing settings. the SharePoint and OneDrive sharing settings at organisation level. Microsoft notes that more restrictive settings can be set for specific sites.
- Site-level exceptions. sites that differ from the organisation setting, and whether each exception has a reason and an owner.
- Guest access. guests in teams and sites, how they were invited, and whether anyone reviews them.
- Sharing links. which link types exist and are used, and links that reach everyone.
- Site and team ownership. sites with no or one owner. SharePoint Advanced Management can enforce a site ownership policy with minimum owner or admin counts.
- Inactive content and expiry. inactive sites and groups, and whether a group expiration policy exists. Microsoft notes an expired Microsoft 365 group is soft-deleted and recoverable for up to 30 days.
- Data access governance reports. what the reports show where available: site permissions, sensitivity labels applied to files, sharing links and sites shared with "Everyone except external users". Microsoft lists prerequisites for SharePoint Advanced Management, so the report notes what your licences allow.
- Sensitivity labels. which labels exist, coverage of important libraries, and whether a default sensitivity label is set for document libraries.
- Data loss prevention. whether Microsoft Purview DLP policies exist for sensitive information, where they apply and what they do when triggered.
- Retention basics. what retention policies and labels exist, what they keep or delete, and who owns them.
- Copilot oversharing risk. Microsoft says Copilot grounds responses in data users already have permission to access, so the report highlights content that is open more widely than intended.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- An oversharing summary by site, using the reports you share
- A guest and ownership summary
- Findings with severity and the evidence behind each one
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over SharePoint and Teams
- Reports and screenshots named in the scope, such as sharing settings, a site permission or data access governance report, guest lists and label settings
- Your plans for Copilot or external collaboration
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the reports and settings in the agreed scope. We do not read document content or sign in to your tenant.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not read your documents, messages or files, change sharing, labels or permissions, or remove guests. We give no assurance that a site is safe.
What needs separate approval. Any change to sharing, permissions, labels, retention or DLP, any guest removal, and any follow-up check after changes.
Questions before an enquiry
Do you read our files?
No. We review reports and settings, not content. If a finding needs an example, the scope agrees what is shared and how.
Do we need SharePoint Advanced Management?
Some reports and policies need it. Microsoft lists prerequisites. The report says what you can use now and what you would need to add. Check current Microsoft documentation.
Is this the same as the AI readiness review?
They overlap on oversharing. This review covers collaboration governance more widely; the AI review adds agents, Copilot readiness and audit.
Will you remove guests or fix permissions?
No. We recommend. Clean-up is your change to approve, or a separate written scope.
Does it cover Teams chats and channel messages?
It covers team and site ownership, guests and sharing settings. It does not review message content.
Free tools, reading and vendor documentation
- AI readiness and governance review
- Microsoft 365 Copilot and SharePoint oversharing
- What are access reviews?
- Copilot limitations: when it is not the right tool
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.