This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
--> Implement security for AI
--> Identify overexposure of data in SharePoint
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Overview
SharePoint is commonly used to store documents, collaboration content, business records, and information accessed by Microsoft 365 Copilot and other AI applications. Although SharePoint permissions determine what users can access, poorly configured permissions and sharing links can expose information to a much broader audience than intended.
For the SC-500 exam, security engineers should understand how to use Microsoft Purview Data Security Posture Management for AI, SharePoint data access governance reports, and related SharePoint controls to identify potentially overshared content and prioritize remediation.
The central security principle is:
AI applications generally respect the permissions of the user making the request. However, if SharePoint content is incorrectly shared with a broad audience, that content may become available to Copilot or other authorized AI experiences through the user’s existing access.
What Is SharePoint Data Overexposure?
Data overexposure occurs when information is accessible to more people, groups, applications, or AI experiences than the organization intended.
Overexposure can result from:
- Excessive SharePoint site permissions.
- Broad Microsoft 365 group membership.
- Broken permission inheritance.
- Sharing links that are too permissive.
- Files shared with Everyone.
- Files or sites shared with Everyone except external users.
- Anonymous or “Anyone” links.
- Content shared with large internal groups.
- Former employees or inappropriate groups retaining access.
- Sensitive files stored in broadly accessible collaboration sites.
- Inadequate review of site ownership and permissions.
Oversharing does not necessarily mean that a file is publicly available on the Internet. A file shared with Everyone except external users may be accessible to every authenticated user in the organization, which can still represent a significant security risk.
Why SharePoint Overexposure Matters for AI
Microsoft 365 Copilot and other AI experiences can use organizational content that the current user is authorized to access. Copilot does not need a separate permission assignment to every document. Instead, it can use the user’s existing Microsoft 365 permissions.
This creates an important relationship:
- A SharePoint file is shared with a broad audience.
- A user receives access through that broad permission.
- The user asks Copilot a question.
- Copilot may use the accessible content when generating a response.
Therefore, an organization may unintentionally expose sensitive information through AI without directly configuring Copilot to share that information.
Examples include:
- Human resources documents shared with all employees.
- Financial forecasts accessible to a broad department.
- Customer records stored in a site with excessive membership.
- Legal documents shared through an “Anyone” link.
- Executive meeting notes accessible through a large internal group.
- Confidential project files inherited from a parent site.
The security issue is usually not that Copilot bypasses SharePoint security. The issue is that the underlying SharePoint permissions are too broad.
Microsoft Purview Data Security Posture Management for AI
Microsoft Purview Data Security Posture Management for AI, often abbreviated as DSPM for AI, helps organizations identify risks involving sensitive data and AI usage.
For SharePoint, DSPM can help security teams:
- Discover potentially overshared content.
- Identify sites containing sensitive information.
- Review sharing links and permission exposure.
- Understand how data may be used as AI grounding data.
- Prioritize remediation.
- Apply sensitivity labels.
- Notify site owners.
- Remove inappropriate sharing links.
- Track and review data exposure over time.
The relevant DSPM capability is the data risk assessment. Microsoft Purview provides default assessments and allows administrators to create custom assessments for selected users or SharePoint sites.
Accessing Data Risk Assessments
A typical workflow is:
- Open the Microsoft Purview portal.
- Navigate to Data Security Posture Management.
- Select Discover.
- Open Data risk assessments.
- Select the Microsoft 365 assessment area.
- Review an existing assessment or create a custom assessment.
- Examine potentially overshared sites and items.
- Prioritize remediation based on sensitivity and exposure.
The default assessment automatically runs weekly for the top SharePoint sites based on usage. Custom assessments can be used when the organization needs to evaluate particular sites, users, or business areas.
Default and Custom Data Risk Assessments
Default assessments
Default assessments provide a recurring view of oversharing risks in frequently used SharePoint sites.
They are useful for:
- Establishing an initial baseline.
- Finding high-usage sites with potential exposure.
- Identifying sites that should be reviewed before or during Copilot deployment.
- Monitoring common oversharing patterns.
The default assessment is not a guarantee that every risky file in the organization has been identified. It focuses on the supported scope of the assessment and its scanning limits.
Custom assessments
Custom assessments allow an administrator to target specific:
- SharePoint sites.
- Users.
- Business units.
- Sensitive data locations.
- High-risk collaboration areas.
Custom assessments are useful when:
- A department is preparing to deploy Copilot.
- A site contains regulated information.
- A security incident involves a specific location.
- A business owner requests a permission review.
- A previous assessment identifies a high-risk site.
- The organization wants to validate remediation.
After a custom assessment runs, results may take time to become available. Assessment results should therefore not be treated as real-time permission telemetry.
Potentially Overshared Items
For supported Microsoft 365 assessments, Purview can identify items that are potentially overshared based on sharing links for:
- External users.
- Anonymous users.
- Broadly accessible audiences.
The item-level results can show information such as:
- The potentially overshared item.
- The SharePoint site containing the item.
- The item owner.
- The applied sensitivity label.
- The type of sharing link or exposure identified.
This allows security teams to investigate individual files rather than reviewing every document in a site manually.
Important distinction
A potentially overshared item is not automatically confirmed to be a security incident.
For example:
- A public marketing brochure may legitimately use an “Anyone” link.
- A confidential financial forecast should not normally use an “Anyone” link.
- A project file may be intentionally shared with external partners.
- A file may have an overly broad link but contain no sensitive information.
The correct response is to evaluate the item’s business purpose, sensitivity, audience, and sharing method.
SharePoint Data Access Governance Reports
SharePoint provides Data access governance reports that help administrators understand how broadly content is exposed.
These reports are available through the SharePoint admin center and can be used alongside Purview assessments.
Important report categories include:
- Site permissions across the organization.
- Site permissions for selected users.
- Sites and files shared through special SharePoint groups.
- Sensitivity labels applied to files.
- Sharing links activity.
- Content shared with Everyone except external users.
These reports provide a broader governance view than an individual file’s sharing dialog.
Site Permissions Across the Organization
The organization-wide site permissions report provides a snapshot of permission exposure across SharePoint and OneDrive sites.
Useful information can include:
- Approximate file count.
- Number of items with unique permissions.
- Number of “People in your organization” links.
- Number of “Anyone” links.
- Number of permissions granted to Everyone except external users.
- Number of permissions granted to Everyone.
- Site sensitivity label information.
This report helps identify sites with:
- Large numbers of users.
- Many unique permissions.
- Extensive use of broad sharing links.
- Large amounts of content with weak access boundaries.
A site with many unique permissions may be difficult to govern because access is granted individually at many levels. A site with many broad links may be easier to use but more difficult to secure.
Site Permissions for a Specific User
The site permissions for users report helps determine which sites a particular user can access and how that access is granted.
Access may be granted:
- Directly to the user.
- Through a SharePoint group.
- Through a Microsoft 365 group.
- Through another group.
- Through site membership.
- Through item-level permissions.
This report is useful for questions such as:
- Which SharePoint sites can this employee access?
- Does the user have access to sensitive sites unrelated to their role?
- Is access direct or inherited through a group?
- Does a user retain access after changing departments?
- Can a privileged or high-risk account access excessive content?
This is especially important when investigating insider-risk concerns, inappropriate access, or the potential impact of a compromised account.
Everyone and Everyone Except External Users
Everyone
The Everyone group represents an extremely broad audience. Depending on the context, content shared with Everyone may be accessible to a very large population.
Files containing confidential information should generally not be shared with Everyone unless the organization has explicitly approved that exposure.
Everyone except external users
The Everyone except external users group, often abbreviated EEEU, includes users inside the organization but excludes external users.
Although this group does not include external guests, it can still expose information to all internal users.
Examples of potentially risky content include:
- Employee compensation information.
- Internal investigations.
- Strategic planning documents.
- Security architecture.
- Customer information.
- Unreleased product plans.
- Legal or regulatory material.
The EEEU report identifies sites and files where this group is used as a permission recipient. These permissions may be assigned at different levels, including sites, libraries, folders, and files.
Sites and Files Shared Through Special SharePoint Groups
The special-groups report is useful when the security team needs to identify the exact items affected by permissions granted to:
- Everyone.
- Everyone except external users.
The report can identify:
- The affected site.
- The affected file or folder.
- The permission level.
- The permission hierarchy.
- The parent group through which access was granted.
This is more actionable than simply knowing that a site is overshared. It allows administrators to create a targeted cleanup plan or use scripting to address the affected permissions.
Sharing Links That Can Cause Overexposure
SharePoint supports several types of sharing links.
Anyone links
An Anyone link can allow access without requiring the recipient to authenticate with an organizational account.
Depending on the configuration, an Anyone link may allow:
- Viewing.
- Editing.
- Downloading.
- Sharing with others.
Anyone links should be carefully controlled because the link may be forwarded beyond the original intended audience.
People in your organization links
A People in your organization link can make content available to authenticated users in the organization.
This may be appropriate for general internal communications but risky for sensitive content.
Specific people links
A Specific people link is more restrictive because it is intended for named recipients.
However, administrators should still review:
- Whether the recipients are correct.
- Whether the recipients still need access.
- Whether the link allows editing.
- Whether the content should have a sensitivity label.
- Whether the link has been forwarded or replaced.
The presence of a sharing link is not automatically a problem. The security risk depends on the link type, content sensitivity, intended audience, and organizational policy.
Activity Reports
Snapshot reports show the current or baseline state of permissions. Activity reports help identify recent sharing behavior.
Important activity reports include:
- Sharing links created recently.
- Content shared with Everyone except external users.
- Sites with unusually high sharing activity.
Activity reports can help detect emerging risks before they become widespread.
For example, a site may not currently have a large number of overshared files, but a sudden increase in Anyone links could indicate:
- A change in business process.
- A new collaboration project.
- User misunderstanding.
- An inappropriate sharing practice.
- A compromised account.
Sharing link activity reports focus on recently active sites and can be used with baseline reports to understand both current exposure and recent changes.
Snapshot Reports Versus Activity Reports
| Report type | Primary purpose |
|---|---|
| Snapshot report | Shows the current or baseline permission state |
| Activity report | Shows recent sharing behavior |
| Site permissions report | Shows how broadly a site is accessible |
| User permissions report | Shows which sites a particular user can access |
| Special-groups report | Identifies specific files and sites shared with Everyone or EEEU |
| Sharing links report | Identifies sites with recent sharing-link activity |
| Sensitivity label report | Helps identify how sensitive content is labeled |
A mature governance program uses both snapshot and activity reports:
- Use snapshot reports to understand the current exposure.
- Use activity reports to identify new or increasing risks.
- Investigate high-risk sites and files.
- Remediate inappropriate access.
- Repeat the assessment periodically.
Sensitivity Labels and SharePoint Overexposure
Sensitivity labels help classify and protect content based on its sensitivity.
Examples of classification categories include:
- Public.
- General.
- Confidential.
- Highly confidential.
A sensitivity label may provide:
- Visual classification.
- Encryption.
- Access restrictions.
- Content marking.
- Protection that persists with the file.
- Policy-based protection.
Sensitivity labels can help security teams distinguish between:
- Content that is intentionally broadly shared.
- Content that is sensitive and should have restricted access.
- Content that is unlabeled and requires review.
An unlabeled file is not necessarily insecure, but unlabeled sensitive content is harder to govern consistently. Purview assessments can help identify potentially overshared items that are unlabeled or may require a different sensitivity label.
Remediation Options
After identifying overexposure, choose remediation based on:
- Sensitivity of the content.
- Number of users with access.
- Whether external users are involved.
- Whether AI applications may use the content.
- Business impact.
- Whether access is intentional.
- Whether the content is still required.
1. Resolve the finding
Use Resolve when the item has been reviewed and the apparent risk is acceptable.
Examples:
- The file is an approved public document.
- The business owner confirms the sharing is intentional.
- The content is not sensitive.
- The item has already been remediated outside the assessment.
Resolving a finding does not necessarily change the permissions. It records that the finding has been reviewed.
2. Apply or change a sensitivity label
Apply a sensitivity label when:
- The item is unlabeled.
- The existing label is too permissive.
- The content requires encryption or access restrictions.
- The organization needs better classification.
3. Notify the site owner
Site owners often understand the business context better than central security teams.
A notification can request that the owner:
- Review the affected item.
- Confirm the intended audience.
- Remove unnecessary access.
- Replace a broad sharing link.
- Apply an appropriate sensitivity label.
- Move the content to a more restricted site.
4. Remove a sharing link
Removing an inappropriate sharing link prevents that link from being used to access the content.
This action should be used carefully because it may disrupt legitimate collaboration. After removing the link, the owner may need to create a more restrictive link for authorized users.
5. Restrict access temporarily
SharePoint capabilities such as Restricted Access Control can be used to limit access to specified groups while remediation is performed.
This can be useful when:
- A site contains highly sensitive information.
- Permissions cannot be reviewed immediately.
- Copilot exposure must be reduced quickly.
- A security investigation is underway.
6. Use restricted content discovery
Restricted content discovery can help prevent high-risk SharePoint sites and files from surfacing in Microsoft Copilot and related agentic experiences while the organization works on remediation.
This is an interim control. It should not replace correcting the underlying permissions and content governance problems.
7. Initiate a site access review
A site access review sends a request to the site owner to review and update access.
A site owner can review:
- Users with access.
- Groups with access.
- Items with broad permissions.
- Sharing links.
- Items with unusually high exposure.
This approach distributes remediation to the people most familiar with the site’s business purpose.
Recommended Investigation Workflow
Step 1: Identify the site or user at risk
Use:
- DSPM data risk assessments.
- Site permissions reports.
- User permissions reports.
- Sharing link activity reports.
- EEEU reports.
Step 2: Determine the exposure type
Identify whether access is granted through:
- An Anyone link.
- A People in your organization link.
- A Specific people link.
- A SharePoint group.
- A Microsoft 365 group.
- Everyone.
- Everyone except external users.
- Direct permissions.
- Inherited permissions.
Step 3: Determine the data sensitivity
Review:
- Sensitivity labels.
- File content.
- Business owner.
- Regulatory classification.
- Customer or employee information.
- Intellectual property.
- Security or legal information.
Step 4: Determine whether the exposure is intentional
Ask:
- Is the audience appropriate?
- Is the file still needed?
- Is external sharing required?
- Is broad internal access justified?
- Is the link type appropriate?
- Is the access temporary or permanent?
Step 5: Prioritize remediation
A useful priority model is:
- Sensitive content shared externally or anonymously.
- Sensitive content shared with Everyone.
- Sensitive content shared with Everyone except external users.
- Sensitive content accessible to large groups.
- Unlabeled content with broad access.
- Low-risk content with legitimate broad sharing.
Step 6: Apply the least disruptive effective control
Possible actions include:
- Remove a broad link.
- Replace it with a Specific people link.
- Remove unnecessary group membership.
- Change site permissions.
- Apply a sensitivity label.
- Initiate a site access review.
- Restrict access temporarily.
- Restrict content discovery while remediation is performed.
Step 7: Validate and document
After remediation:
- Re-run the assessment or report.
- Confirm that access is reduced as intended.
- Verify that legitimate users retain access.
- Document the business justification.
- Record the owner and remediation date.
- Monitor for recurrence.
Important Limitations and Considerations
Assessments are not necessarily real-time
Reports and assessments may have processing delays. A newly changed permission may not appear immediately.
Do not assume that a report showing no issue proves that the current configuration is risk-free.
OneDrive and SharePoint coverage can differ
Some item-level scanning capabilities are limited to SharePoint sites. OneDrive support and reporting methods may differ depending on the specific feature and current service capabilities.
Broad access is not always inappropriate
A public brochure, product announcement, or company policy may legitimately be shared broadly.
Security engineers must evaluate the context rather than automatically removing every broad link.
Removing links may disrupt business operations
Removing a sharing link can prevent legitimate recipients from accessing the content. Use owner review and business validation where possible.
Fix permissions, not just AI visibility
Restricted content discovery can reduce the chance that content appears in Copilot or agentic experiences, but the underlying SharePoint permissions should still be corrected.
Common Exam Traps
Trap 1: Copilot bypasses SharePoint permissions
Incorrect. Copilot generally uses the current user’s authorized access. The risk often comes from excessive SharePoint permissions.
Trap 2: Everyone except external users means secure
Incorrect. It excludes external users but may grant access to every internal user.
Trap 3: An Anyone link always indicates a security incident
Incorrect. The link may be intentional for public content. The content’s sensitivity and business purpose must be evaluated.
Trap 4: A site permissions report identifies every affected file
Not necessarily. Site-level reports identify exposure patterns. Item-level reports, such as the special-groups report, are needed to identify specific files and folders affected by certain broad permissions.
Trap 5: Restricted content discovery fixes the permissions
Incorrect. It is an interim control that can reduce AI discovery exposure. The underlying permissions should still be remediated.
Trap 6: A resolved finding automatically removes access
Incorrect. Resolving a finding records that it has been reviewed. It does not necessarily change the item’s permissions.
Trap 7: Activity reports and snapshot reports serve the same purpose
Incorrect. Snapshot reports describe the current or baseline state. Activity reports focus on recent sharing behavior.
Trap 8: Every unlabeled file is insecure
Incorrect. Lack of a sensitivity label is a governance concern, but the actual risk depends on the content and access permissions.
Practice Exam Questions
Question 1
An organization is preparing to deploy Microsoft 365 Copilot. The security team wants to identify SharePoint content that may be accessible to a broader audience than intended. Which capability is most appropriate?
A. Microsoft Defender for Endpoint
B. Microsoft Purview Data Security Posture Management data risk assessments
C. Azure Network Watcher
D. Azure Firewall
Answer: B
Explanation: Purview DSPM data risk assessments help identify potentially overshared Microsoft 365 content, including SharePoint data that may affect AI grounding and Copilot responses.
Question 2
A SharePoint document is shared with Everyone except external users. What is the primary security concern?
A. The document is automatically encrypted with a Microsoft-managed key.
B. Only the site owner can access the document.
C. The document is available only to external guests.
D. The document may be accessible to all authenticated users inside the organization.
Answer: D
Explanation: Everyone except external users excludes external users but can expose the document to the entire internal organization.
Question 3
A security engineer needs to identify the exact files and folders that have permissions granted to Everyone or Everyone except external users. Which report should be used?
A. Sites and files shared via special SharePoint groups report
B. Azure Activity Log
C. Microsoft Defender for Servers report
D. Site collection storage report
Answer: A
Explanation: The special-groups report identifies the specific sites, files, and folders affected by permissions granted to Everyone or Everyone except external users.
Question 4
A security team wants to understand which SharePoint sites a particular employee can access and whether access is direct or inherited through groups. Which report is most appropriate?
A. Sharing links activity report
B. Site permissions for users report
C. Sensitivity labels for files report
D. External attack surface report
Answer: B
Explanation: The site permissions for users report shows the sites a specified user can access and how access is granted.
Question 5
A potentially overshared file is identified in Purview. The file contains confidential financial information and is currently unlabeled. What is an appropriate remediation action?
A. Apply an appropriate sensitivity label and review the sharing permissions.
B. Resolve the finding without reviewing it.
C. Make the file available to Everyone.
D. Disable Microsoft 365 Copilot for the entire tenant.
Answer: A
Explanation: Sensitive unlabeled content should be classified and its permissions reviewed. Applying a sensitivity label can improve protection and governance.
Question 6
A site owner confirms that a file identified by a Purview assessment is an approved public marketing brochure. What should the security engineer do if the sharing is intentional and acceptable?
A. Delete the SharePoint site.
B. Remove all site members.
C. Resolve the finding after documenting the business justification.
D. Apply a highly confidential label automatically.
Answer: C
Explanation: Not every broad sharing configuration is inappropriate. If the exposure is intentional and approved, the finding can be resolved after review.
Question 7
A security team wants to identify newly created sharing links that may introduce oversharing risks. Which capability should it use?
A. Site storage metrics
B. Sharing links activity reports
C. Azure Resource Graph
D. Microsoft Entra Connect Health
Answer: B
Explanation: Sharing links activity reports identify sites with recent sharing-link activity and help detect emerging oversharing risks.
Question 8
An organization discovers that a high-risk SharePoint site may expose sensitive content to Copilot users. The permissions cannot be fully reviewed immediately. Which interim control may help reduce the content’s visibility in Copilot and agentic experiences?
A. Disable all Microsoft Entra users.
B. Delete all sensitivity labels.
C. Enable restricted content discovery for the high-risk content.
D. Remove every NSG from the organization.
Answer: C
Explanation: Restricted content discovery can help prevent high-risk SharePoint content from surfacing in Copilot and related agentic experiences while the organization remediates the underlying access risks.
Question 9
Which statement best describes the difference between a snapshot report and an activity report?
A. A snapshot report shows a permission baseline, while an activity report focuses on recent sharing behavior.
B. A snapshot report only applies to Azure virtual machines, while an activity report applies to SharePoint.
C. A snapshot report changes permissions automatically, while an activity report deletes files.
D. A snapshot report identifies malware, while an activity report identifies vulnerabilities.
Answer: A
Explanation: Snapshot reports describe the current or baseline permission state. Activity reports focus on recent sharing activity that may introduce new exposure.
Question 10
A security engineer removes an inappropriate Anyone sharing link from a sensitive SharePoint file. What should the engineer do next?
A. Assume that all access to the file is now impossible.
B. Validate that authorized users still have appropriate access and confirm that the broad link is no longer usable.
C. Grant Everyone access as a replacement.
D. Disable SharePoint for the entire organization.
Answer: B
Explanation: Removing a sharing link may affect legitimate collaboration. The engineer should validate the resulting access and ensure that authorized users retain an appropriate, more restrictive access method.
Summary
For the SC-500 exam, remember these key points:
- SharePoint overexposure occurs when content is accessible to a broader audience than intended.
- Copilot generally uses the current user’s existing permissions.
- Excessive SharePoint permissions can therefore create AI data exposure risks.
- Purview DSPM data risk assessments help identify potentially overshared content.
- SharePoint Data access governance reports provide organization-wide, user-specific, item-level, and activity-based visibility.
- Everyone except external users can expose content to all internal users.
- Anyone links can expose content beyond the organization and should be reviewed carefully.
- Snapshot reports show the current or baseline state.
- Activity reports identify recent sharing behavior.
- Sensitivity labels help classify and protect sensitive content.
- Remediation may include changing permissions, removing links, applying labels, notifying site owners, initiating access reviews, or temporarily restricting content discovery.
- Restricted content discovery is an interim AI-visibility control, not a replacement for correcting SharePoint permissions.
- Always validate the business purpose before removing legitimate access.
Go to the SC-500 Exam Prep Hub main page
