How SharePoint data access governance reports and Purview data risk assessments help to find oversharing.
From Ultra Transcenders AB-650 by Tony Rough (coming November 2026)
Two toolsets find oversharing: SharePoint data access governance reports and Purview data risk assessments. They overlap, so know what each reports.
Data access governance (DAG) reports live in the SharePoint admin center under Reports > Data access governance and need SAM.
| Report type | Report | What it shows |
|---|---|---|
| Snapshot | Site permissions across your organisation | Permission structure of all SharePoint and OneDrive sites; sites with thousands of users, guests or “Everyone except external users” |
| Snapshot | Site permissions for users | Every site a named user can reach, directly or through groups |
| Snapshot | Sensitivity labels for files | Sites that contain files with chosen labels |
| Snapshot | Items shared through special SharePoint groups | The exact files and folders exposed through “Everyone” or “Everyone except external users” |
| Activity (last 28 days) | Sharing links | Sites where users created the most links (Anyone, People in the organisation, Specific people) |
| Activity (last 28 days) | Shared with “Everyone except external users” | Sites where content was shared with all internal users |
Run snapshot reports first (about quarterly) for the baseline, then activity reports (about monthly) to catch new exposure. Without SAM, an admin with Microsoft 365 E5 can open the reports but gets no snapshot reports or remediation actions, and activity reports return at most 10,000 sites. Activity reports on a tenant without SAM need data collection enabled first: audit data is kept for 28 days, reports appear 24 hours after switching it on, and collection pauses if no report is generated for three months.
Site access review hands the cleanup to site owners, because compliance rules stop IT admins seeing file-level detail. From the DAG web view an admin can start reviews for up to 100 sites at once; use PowerShell for more. Up to 1,000 reviews can be started from the site permissions report each calendar month. Reviews work for SharePoint sites only, not OneDrive, and are not supported in Microsoft 365 operated by 21Vianet.
Data risk assessments in Microsoft Purview Data Security Posture Management (DSPM) are at DSPM > Discover > Data risk assessments.
| Assessment | Behaviour |
|---|---|
| Default | Runs weekly over the 100 most-used SharePoint sites (and Fabric workspaces once configured); first run has a four-day delay |
| Custom | You pick users and data sources; allow at least 48 hours for results; results expire after 30 days, so duplicate it to rerun |
| Item-level scan (optional) | Microsoft 365 only, SharePoint sites only, up to 10 sites; needs a registered Entra app; flags items with external or anonymous links |
Both kinds scan a maximum of 200,000 items per location. The flyout for each site has Overview, Identify, Protect and Monitor tabs. Protect offers four fixes: restrict access by label (a DLP policy), restrict all items (SharePoint restricted content discovery), create an auto-labelling policy for unlabelled sensitive files, and create a retention policy to delete content not accessed for at least three years. Item-level actions include applying a label, notifying the site owner by email, and removing a sharing link; use the last one sparingly because it can lock out legitimate users. Both assessment types can be exported to Excel, CSV, JSON or TSV.
Common trap: Assuming the default data risk assessment scans every site - it covers the top 100 sites by usage. Run a custom assessment to examine other sites or specific users.
This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.
Due on Amazon in November 2026, in Kindle and paperback editions.
About the book · AB-650 terms in the glossary · All AB-650 study notes
Which groups can carry licences, who can assign them and how membership drives access.
How administrative units scope roles to a subset of users, groups and devices.
How built-in and custom authentication strengths define which method combinations satisfy a policy.
How a Conditional Access policy combines assignments, conditions and access controls.
What the harmless phishing simulations are, and the licence and permissions needed to run them.
What the Copilot policy location is, which template offers it and the controls it provides.
The three audience options for when tenant users receive new features, and where Frontier fits.
Where Copilot issues are tracked: Service health for incidents and Message center for changes.