Tag: Data Governance

Run a data access governance report in SharePoint (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Run a data access governance report in SharePoint


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

That is an excellent next topic for the AB-900 exam because it combines SharePoint governance, Microsoft Purview, and Copilot data security. Although the feature continues to evolve, the exam focuses on understanding what the report is, when to use it, and what problems it helps administrators solve, rather than memorizing every UI step.


Why Data Access Governance Matters

One of the largest security challenges in Microsoft 365 is oversharing. Over time, organizations accumulate millions of files, thousands of SharePoint sites, and numerous Microsoft Teams workspaces. Permissions often become increasingly complex as users:

  • Share files externally
  • Create anonymous sharing links
  • Grant access to “Everyone”
  • Add guests to Teams
  • Break inheritance on folders
  • Forget to remove temporary permissions

As organizations adopt Microsoft 365 Copilot, overshared content becomes an even greater concern because Copilot can surface information that a user already has permission to access—even if that access was unintentionally granted.

Microsoft provides Data Access Governance (DAG) capabilities in SharePoint to help administrators discover, understand, and remediate excessive access before it becomes a security issue.


What is Data Access Governance?

Data Access Governance is a collection of reporting and analysis capabilities within SharePoint Advanced Management that helps administrators answer questions such as:

  • Which sites are accessible by everyone?
  • Which files are overshared?
  • Which sites have external users?
  • Which sites contain highly sensitive information?
  • Which permissions may expose confidential content?
  • Which sites should be reviewed?

Rather than examining permissions one site at a time, administrators receive organization-wide visibility.


Primary Goals of Data Access Governance

Data Access Governance helps organizations:

  • Discover overshared sites
  • Review permissions
  • Reduce excessive access
  • Identify high-risk collaboration
  • Improve Microsoft 365 security posture
  • Prepare for Microsoft 365 Copilot deployment
  • Reduce accidental data exposure
  • Support compliance initiatives

Why It Is Important for Microsoft 365 Copilot

Microsoft 365 Copilot never ignores permissions.

Instead, it retrieves content using the same security model that governs Microsoft 365.

If a user has permission to open a document manually, Copilot can potentially reference that document when generating responses.

For example:

Suppose Human Resources accidentally grants the entire company read access to salary spreadsheets.

Without Copilot:

  • Most employees may never discover the files.

With Copilot:

A user might ask:

“Summarize employee compensation data.”

Because the files are already accessible, Copilot could retrieve them.

The problem is not Copilot—it is the underlying permissions.

Data Access Governance helps identify these permission problems before they become security risks.


What the Data Access Governance Report Shows

The report provides administrators with visibility into SharePoint permissions and sharing configurations across the tenant.

Common information includes:

  • Site owners
  • Site sensitivity
  • External sharing status
  • Number of members
  • Anonymous links
  • Organization-wide access
  • Guest access
  • Sharing activity
  • Permission inheritance
  • Access patterns
  • High-risk sites
  • Overshared content indicators

Rather than searching manually, administrators can prioritize the highest-risk locations.


Types of Oversharing That Can Be Identified

The report can identify situations such as:

Organization-wide access

Sites accessible by:

  • Everyone
  • Everyone except external users
  • Large security groups

These sites often expose more content than intended.


Anonymous Links

Files shared through links that require no authentication.

These links may remain active long after they are needed.


Guest Access

Sites containing:

  • External users
  • Partner accounts
  • Vendor accounts

Administrators can verify whether guest access is still appropriate.


Excessive Sharing

Examples include:

  • Large numbers of shared files
  • Broad sharing permissions
  • Public document libraries
  • Open collaboration spaces

Sensitive Sites

The report can identify sites that contain:

  • Financial information
  • HR records
  • Legal documents
  • Intellectual property
  • Customer information

Combined with Microsoft Purview sensitivity labels, administrators gain better visibility into where important information resides.


Typical Workflow

Administrators generally follow this process:

Step 1

Open SharePoint administration tools.


Step 2

Generate or review a Data Access Governance report.


Step 3

Review identified risks.

Examples:

  • Overshared sites
  • External sharing
  • Everyone permissions
  • Sensitive content

Step 4

Investigate high-risk sites.

Questions include:

  • Does this access need to exist?
  • Are guests still required?
  • Is inheritance broken?
  • Should permissions be reduced?

Step 5

Take corrective action.

Possible actions include:

  • Remove permissions
  • Restrict sharing
  • Apply sensitivity labels
  • Disable anonymous links
  • Reduce guest access
  • Educate site owners

Step 6

Run reports regularly to verify improvements.


Relationship with Microsoft Purview

Data Access Governance works alongside Microsoft Purview.

Purview answers questions such as:

  • What sensitive data exists?
  • How is it classified?
  • Which labels are applied?
  • Are DLP policies triggered?

SharePoint Data Access Governance answers:

  • Who can access the data?
  • Is the data overshared?
  • Which sites expose information?
  • Which permissions should be reviewed?

Together they provide both:

  • Content awareness
  • Permission awareness

Relationship with Microsoft 365 Copilot

Data Access Governance helps administrators prepare for Copilot by reducing permission-related risks.

Benefits include:

  • Finding overshared SharePoint sites
  • Identifying unnecessary permissions
  • Reducing broad access
  • Reviewing guest sharing
  • Protecting confidential information
  • Improving search security
  • Supporting Zero Trust principles

Best Practices

Microsoft recommends that organizations:

  • Review sharing reports regularly.
  • Audit external access periodically.
  • Minimize “Everyone” permissions.
  • Remove unused guest accounts.
  • Apply sensitivity labels to important sites.
  • Use Microsoft Purview DLP alongside SharePoint governance.
  • Educate site owners on responsible sharing.
  • Review high-risk collaboration sites before deploying Copilot broadly.
  • Follow the principle of least privilege.
  • Continuously monitor permission changes.

Common Exam Tips

Remember these key points:

  • Data Access Governance focuses on permissions and access, not document content.
  • It helps identify oversharing across SharePoint.
  • It is especially valuable before deploying Microsoft 365 Copilot.
  • Copilot respects existing Microsoft 365 permissions.
  • Oversharing is a permissions problem, not a Copilot problem.
  • Reports help administrators prioritize high-risk sites for remediation.
  • Data Access Governance complements Microsoft Purview rather than replacing it.

Practice Exam Questions

Question 1

Why would an administrator run a Data Access Governance report in SharePoint?

A. To update SharePoint servers

B. To identify overshared sites and permission risks

C. To encrypt all documents automatically

D. To generate Microsoft 365 licenses

Correct Answer: B

Explanation: Data Access Governance helps administrators identify sites with excessive permissions, external sharing, and other access-related risks.


Question 2

Which issue is Data Access Governance primarily designed to identify?

A. SQL database corruption

B. Printer failures

C. Oversharing of SharePoint content

D. Network latency

Correct Answer: C

Explanation: The primary purpose is to detect oversharing and excessive permissions across SharePoint.


Question 3

Why is Data Access Governance especially important before deploying Microsoft 365 Copilot?

A. Copilot automatically changes permissions.

B. Copilot ignores SharePoint security.

C. Copilot copies all SharePoint files.

D. Copilot can reference content users already have permission to access.

Correct Answer: D

Explanation: Copilot honors existing permissions. Overshared content may therefore appear in Copilot responses if users already have legitimate access.


Question 4

Which type of access represents a potential oversharing risk?

A. Anonymous sharing links

B. Azure subscription ownership

C. Exchange mailbox size

D. Microsoft Teams background images

Correct Answer: A

Explanation: Anonymous links allow access without authentication and should be reviewed carefully.


Question 5

What question does Data Access Governance primarily help answer?

A. Which users have excessive access to SharePoint content?

B. Which Windows updates are missing?

C. Which devices need antivirus software?

D. Which Microsoft 365 licenses should be purchased?

Correct Answer: A

Explanation: Data Access Governance focuses on permissions, sharing, and access to SharePoint content.


Question 6

Which Microsoft 365 principle is supported by regularly reviewing Data Access Governance reports?

A. Unlimited collaboration

B. Least privilege

C. Maximum storage allocation

D. Unlimited guest access

Correct Answer: B

Explanation: Regular reviews help ensure users have only the permissions necessary to perform their work.


Question 7

Which type of SharePoint site would likely appear as higher risk in a Data Access Governance report?

A. A private HR site with restricted access

B. A site shared with only one administrator

C. A site containing sensitive files that is accessible to everyone

D. A newly created empty site

Correct Answer: C

Explanation: Sensitive information combined with broad permissions represents a significant oversharing risk.


Question 8

How does Data Access Governance complement Microsoft Purview?

A. Both products only classify documents.

B. Data Access Governance focuses on permissions, while Purview focuses on data protection and governance.

C. They perform identical functions.

D. Purview replaces SharePoint permissions.

Correct Answer: B

Explanation: Purview governs and protects data, while Data Access Governance helps administrators understand who has access to that data.


Question 9

Which action should an administrator consider after identifying an overshared SharePoint site?

A. Delete all documents immediately.

B. Disable Microsoft 365 Copilot.

C. Purchase additional SharePoint storage.

D. Review and reduce unnecessary permissions.

Correct Answer: D

Explanation: The appropriate response is to evaluate existing permissions and remove excessive or unnecessary access while maintaining business needs.


Question 10

Which statement about Microsoft 365 Copilot and Data Access Governance is true?

A. Data Access Governance prevents all Copilot responses.

B. Copilot bypasses SharePoint permissions when generating answers.

C. Data Access Governance helps reduce the risk of Copilot surfacing overshared information by identifying excessive permissions.

D. Copilot encrypts all SharePoint documents before using them.

Correct Answer: C

Explanation: By identifying and remediating overshared permissions, Data Access Governance helps ensure Copilot only surfaces information that users are appropriately authorized to access.


Go to the AB-900 Exam Prep Hub main page

Common Data Mistakes Businesses Make (and How to Fix Them)

Most organizations don’t fail at data because they lack tools or technology. They fail, or have sub-optimal data outcomes, because of small, repeated mistakes that quietly undermine trust, decision-making, and value. The good news is that these mistakes are fixable.

Here we outline a few of the common mistakes and how to fix them.


Treating Data as an Afterthought

The mistake:
Data is considered only after systems are built, processes are defined, or decisions are already made. Analytics becomes reactive instead of intentional.

How to fix it:
Bring data thinking into the earliest stages of planning. Define what success looks like, what needs to be measured, and how data will be captured before solutions go live.


Measuring Everything Instead of What Matters

The mistake:
Dashboards become crowded with metrics that look interesting but don’t influence decisions. Teams spend more time reporting than acting.

How to fix it:
Identify a small set of actionable metrics and KPIs aligned to business goals. If a metric doesn’t inform a decision or behavior, question why it exists.


Confusing Metrics with KPIs

The mistake:
Operational metrics are treated as strategic indicators, or KPIs are defined without clear ownership or accountability.

How to fix it:
Clearly distinguish between metrics and KPIs. Assign owners to each KPI and ensure they are reviewed regularly with a focus on decisions and outcomes.


Poor or Inconsistent Definitions

The mistake:
Different teams use the same terms—such as “customer,” “active user,” or “revenue”—but mean different things. This leads to conflicting numbers and erodes trust.

How to fix it:
Create and maintain shared definitions through a business glossary or semantic layer. Make definitions visible and easy to reference, not hidden in documentation no one reads.


Ignoring Data Quality Until It’s a Crisis

The mistake:
Data quality issues are only addressed after reports are wrong, decisions are challenged, or leadership loses confidence.

How to fix it:
Treat data quality as an ongoing discipline. Monitor freshness, completeness, accuracy, and consistency. Build checks into pipelines and surface issues early.


Relying Too Much on Manual Processes

The mistake:
Critical reports depend on spreadsheets, manual data pulls, or individual expertise. This creates risk, delays, and scalability issues.

How to fix it:
Automate data pipelines and reporting wherever possible. Reduce dependency on individuals and create repeatable, documented processes.


Focusing on Tools Instead of Understanding

The mistake:
Organizations invest heavily in BI tools, data platforms, or AI features but don’t invest equally in data literacy.

How to fix it:
Train users to understand data, ask better questions, and interpret results correctly. The value of data comes from people, not platforms.


Lacking Clear Ownership and Governance

The mistake:
No one is accountable for data domains, leading to duplication, inconsistency, and confusion.

How to fix it:
Define clear ownership for data domains, datasets, and KPIs. Lightweight governance—focused on clarity and accountability—often works better than rigid controls.


Using Historical Data Only

The mistake:
Decisions are based solely on past performance, with little attention to leading indicators or real-time signals.

How to fix it:
Complement historical reporting with forward-looking and operational metrics. Trends, early signals, and predictive indicators enable proactive decision-making.


Losing Sight of the Business Question

The mistake:
Teams focus on building reports and models without a clear understanding of the business problem they’re trying to solve.

How to fix it:
Start every data initiative with a simple question: What decision will this support? Let the question drive the data—not the other way around.


In Summary

Most data problems aren’t technical—they’re organizational, cultural, or conceptual. Businesses that succeed with data focus less on collecting more information and more on creating clarity, trust, and action.

Strong data practices don’t just produce insights. They enable better decisions, faster responses, and sustained business value.

Thanks for reading and good luck on your data journey!

Glossary – 100 “Data Governance” Terms

Below is a glossary that includes 100 “Data Governance” terms and phrases, along with their definitions and examples, in alphabetical order. Enjoy!

TermDefinition & Example
Access ControlRestricting data access. Example: Role-based permissions.
Audit TrailRecord of data access and changes. Example: Who updated records.
Business GlossaryStandardized business terms. Example: Definition of “Revenue”.
Business MetadataBusiness context of data. Example: KPI definitions.
Change ManagementManaging governance adoption. Example: New policy rollout.
Compliance AuditFormal governance assessment. Example: External audit.
Consent ManagementTracking user permissions. Example: Marketing opt-ins.
ControlMechanism to reduce risk. Example: Access approval workflows.
Control FrameworkStructured control set. Example: SOX controls.
Data AccountabilityClear responsibility for data outcomes. Example: Named data owners.
Data Accountability ModelFramework assigning responsibility. Example: Owner–steward mapping.
Data AccuracyCorrectness of data values. Example: Valid email addresses.
Data ArchivingMoving inactive data to long-term storage. Example: Historical logs.
Data BreachUnauthorized data exposure. Example: Leaked customer records.
Data CatalogCentralized inventory of data assets. Example: Enterprise data catalog tool.
Data CertificationMarking trusted datasets. Example: “Certified” badge.
Data ClassificationCategorizing data by sensitivity. Example: Public vs confidential.
Data CompletenessPresence of required data. Example: No missing customer IDs.
Data ComplianceAdherence to internal policies. Example: Quarterly audits.
Data ConsistencyUniform data representation. Example: Same currency everywhere.
Data ContractAgreement on data structure and SLAs. Example: Producer-consumer contract.
Data CustodianTechnical role managing data infrastructure. Example: Database administrator.
Data DictionaryRepository of field definitions. Example: Column descriptions.
Data DisposalSecure deletion of data. Example: End-of-life purging.
Data DomainLogical grouping of data. Example: Finance data domain.
Data EthicsResponsible use of data. Example: Avoiding discriminatory models.
Data GovernanceFramework of policies, roles, and processes for managing data. Example: Enterprise data governance program.
Data Governance CharterFormal governance mandate. Example: Executive-approved charter.
Data Governance CouncilOversight group for governance decisions. Example: Cross-functional committee.
Data Governance MaturityLevel of governance capability. Example: Ad hoc vs optimized.
Data Governance PlatformIntegrated governance tooling. Example: Enterprise governance suite.
Data Governance RoadmapPlanned governance initiatives. Example: 3-year roadmap.
Data HarmonizationAligning data definitions. Example: Unified metrics.
Data IntegrationCombining data from multiple sources. Example: CRM + ERP merge.
Data IntegrityTrustworthiness across lifecycle. Example: Referential integrity.
Data Issue ManagementTracking and resolving data issues. Example: Data quality tickets.
Data LifecycleStages from creation to disposal. Example: Create → archive → delete.
Data LineageTracking data from source to consumption. Example: Source → dashboard mapping.
Data LiteracyAbility to understand and use data. Example: Training programs.
Data MaskingObscuring sensitive data. Example: Masked credit card numbers.
Data MeshDomain-oriented governance approach. Example: Decentralized ownership.
Data MonitoringContinuous oversight of data. Example: Schema change alerts.
Data ObservabilityMonitoring data health. Example: Freshness alerts.
Data OwnerAccountable role for a dataset. Example: VP of Sales owns sales data.
Data Ownership MatrixMapping data to owners. Example: RACI chart.
Data Ownership ModelAssignment of accountability. Example: Business-owned data.
Data Ownership TransferChanging ownership responsibility. Example: Org restructuring.
Data PolicyHigh-level rules for data handling. Example: Data retention policy.
Data PrivacyProper handling of personal data. Example: GDPR compliance.
Data ProductGoverned, consumable dataset. Example: Curated sales table.
Data ProfilingAssessing data characteristics. Example: Null percentage analysis.
Data QualityAccuracy, completeness, and reliability of data. Example: No duplicate customer IDs.
Data Quality RuleCondition data must meet. Example: Order date cannot be null.
Data RetentionRules for how long data is kept. Example: 7-year retention policy.
Data Review ProcessPeriodic governance review. Example: Policy refresh.
Data RiskPotential harm from data misuse. Example: Regulatory fines.
Data SecuritySafeguarding data from unauthorized access. Example: Encryption at rest.
Data Sharing AgreementRules for sharing data. Example: Partner data exchange.
Data StandardAgreed-upon data definition or format. Example: ISO country codes.
Data StewardshipOperational responsibility for data quality and usage. Example: Business steward for customer data.
Data TimelinessData availability when needed. Example: Daily refresh SLA.
Data TraceabilityAbility to trace data changes. Example: Transformation history.
Data TransparencyVisibility into data usage and meaning. Example: Open definitions.
Data TrustConfidence in data reliability. Example: Executive reporting.
Data Usage PolicyRules for data consumption. Example: Analytics-only usage.
Data ValidationChecking data against rules. Example: Type and range checks.
EncryptionEncoding data for protection. Example: AES encryption.
Enterprise Data GovernanceOrganization-wide governance approach. Example: Company-wide standards.
Exception ManagementHandling rule violations. Example: Approved data overrides.
Federated GovernanceShared governance model. Example: Domain-level ownership.
Golden RecordSingle trusted version of an entity. Example: Unified customer profile.
Governance FrameworkStructured governance approach. Example: DAMA-DMBOK.
Governance MetricsMeasurements of governance success. Example: Issue resolution time.
Impact AnalysisAssessing effects of data changes. Example: Column removal impact.
Incident ResponseHandling data security incidents. Example: Breach mitigation plan.
KPI (Governance KPI)Metric for governance effectiveness. Example: Data quality score.
Least PrivilegeMinimum access needed principle. Example: Read-only analyst access.
Master DataCore business entities. Example: Customers, products.
MetadataInformation describing data. Example: Column definitions.
Metadata ManagementManaging metadata lifecycle. Example: Automated harvesting.
Operating ControlsDay-to-day governance controls. Example: Access reviews.
Operating ModelHow governance roles interact. Example: Centralized governance.
Operational MetadataData about data processing. Example: Load timestamps.
Personally Identifiable Information (PII)Data identifying individuals. Example: Social Security number.
Policy EnforcementEnsuring policies are followed. Example: Automated checks.
Policy ExceptionApproved deviation from policy. Example: Temporary access grant.
Policy LifecycleCreation, approval, review of policies. Example: Annual updates.
Protected Health Information (PHI)Health-related personal data. Example: Medical records.
Reference ArchitectureStandard governance architecture. Example: Approved tooling stack.
Reference DataControlled value sets. Example: Country lists.
Regulatory ComplianceMeeting legal data requirements. Example: GDPR, CCPA.
Risk AssessmentEvaluating governance risks. Example: Privacy risk scoring.
Risk ManagementIdentifying and mitigating data risks. Example: Privacy risk assessment.
Sensitive DataData requiring protection. Example: Financial records.
SLA (Service Level Agreement)Data delivery expectations. Example: Refresh by 8 AM.
Stakeholder EngagementInvolving business users. Example: Governance workshops.
Stewardship ModelStructure of stewardship roles. Example: Business and technical stewards.
Technical MetadataSystem-level data information. Example: Data types and schemas.
TokenizationReplacing sensitive data with tokens. Example: Payment systems.
Tooling EcosystemSet of governance tools. Example: Catalog + lineage tools.

Promote or certify Power BI content (PL-300 Exam Prep)

This post is a part of the PL-300: Microsoft Power BI Data Analyst Exam Prep Hub; and this topic falls under these sections:
Manage and secure Power BI (15–20%)
--> Create and manage workspaces and assets
--> Promote or certify Power BI content


Note that there are 10 practice questions (with answers and explanations) at the end of each topic. Also, there are 2 practice tests with 60 questions each available on the hub below all the exam topics.

Overview

In Power BI, promoting and certifying content helps organizations establish trust, data governance, and self-service analytics at scale. These features allow users to quickly identify which datasets, reports, and dataflows are approved for reuse and suitable for decision-making.

For the PL-300 exam, you must understand:

  • The difference between promoted and certified content
  • Who can promote or certify content
  • Which Power BI artifacts support these labels
  • How promotion and certification impact discovery, reuse, and governance

What Does It Mean to Promote Content?

Promoted content indicates that an item is recommended for use, but it has not gone through a formal certification process.

Key Characteristics of Promoted Content

  • Signals good quality and usefulness
  • Often created by experienced report authors or teams
  • Does not require tenant-level approval
  • Can be promoted by:
    • Dataset owners
    • Workspace members (depending on permissions)

Supported Artifacts

  • Datasets (semantic models)
  • Dataflows
  • Reports

Common Use Cases

  • Department-level datasets
  • Team-managed reports
  • Content that is reliable but still evolving

What Does It Mean to Certify Content?

Certified content represents the highest level of trust in Power BI. It indicates that the content has been reviewed, approved, and governed according to organizational standards.

Key Characteristics of Certified Content

  • Approved by authorized reviewers
  • Requires Power BI tenant admin configuration
  • Used as a single source of truth
  • Clearly marked with a Certified badge

Who Can Certify Content?

  • Users assigned as certifiers by a Power BI tenant administrator
  • Typically part of:
    • IT
    • Data governance
    • Center of Excellence (CoE)

Supported Artifacts

  • Datasets (semantic models)
  • Dataflows

Important for the exam:
Reports cannot be certified directly — certification applies to the underlying dataset or dataflow.


Promote vs. Certify: Key Differences

FeaturePromotedCertified
Approval requiredNoYes
Tenant admin involvementNoYes
Trust levelMediumHigh
Intended audienceTeam or departmentOrganization-wide
Governance reviewInformalFormal
Exam relevanceMediumHigh

How Promotion and Certification Affect Users

When users browse content in Power BI:

  • Certified items appear first in searches
  • Users are encouraged to build new reports using certified datasets
  • Reduces duplication of datasets and metrics
  • Improves consistency across reports and dashboards

This directly supports self-service analytics with governance, a recurring PL-300 theme.


Where Promotion and Certification Are Configured

Promotion and certification are managed in:

  • Power BI Service
  • Dataset or dataflow Settings
  • Workspace context (not Power BI Desktop)

Tenant admins control:

  • Whether certification is enabled
  • Who can certify content

Exam Scenarios to Watch For

On the PL-300 exam, expect scenarios like:

  • Choosing between promoted vs. certified content
  • Identifying who can certify a dataset
  • Determining why a report cannot be certified
  • Understanding how certification affects dataset reuse

Best Practices (Exam-Relevant)

  • Promote content that is reliable but not formally governed
  • Certify content that is:
    • Widely used
    • Business-critical
    • Carefully validated
  • Use certification to enforce:
    • Metric consistency
    • Trusted KPIs
    • Enterprise reporting standards

Key Takeaways for PL-300

  • Promotion = recommended, informal trust
  • Certification = governed, enterprise-approved trust
  • Only datasets and dataflows can be certified
  • Certification requires tenant admin setup
  • Certified content supports scalable self-service BI

Practice Questions

Go to the Practice Questions for this topic.