An add-on for SharePoint governance, bundled with Microsoft 365 Copilot, that helps detect and cut oversharing via site access reviews, restricted content discovery, restricted access control and data access governance reports.
Also called SAM.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains SharePoint Advanced Management in context, with comparison tables and the common traps.
Terms in this definition
- Governance
Keeping cloud deployments in line with an organisation's rules on technology, security and compliance, helped by Azure Policy, tags and resource locks.
- Microsoft 365 Copilot
Assistant built into Microsoft 365 apps that grounds its answers in an organisation's data via Microsoft Graph. Because it respects existing permissions, content that has been overshared can appear in responses.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- Access reviews
Microsoft Entra ID Governance capability that periodically asks reviewers or users themselves to confirm membership for guests, app users or groups, removing anyone who does not respond. PIM, by contrast, handles privileged roles.
- Restricted Content Discovery
A per-site SharePoint Advanced Management option that hides a site from organisation-wide search and from Microsoft Copilot answers while leaving its permissions untouched. People who have access can still open its files directly.
- Restricted access control
A SharePoint Advanced Management policy that only lets people in chosen Microsoft 365 or security groups into a particular SharePoint site or OneDrive, overriding permissions or links they held before. Search and Copilot respect the restriction.
- Data access governance reports
Oversharing reports found in the SharePoint admin center with SharePoint Advanced Management. Snapshot reports list site permissions and content shared with Everyone or EEEU, while activity reports track sharing links and EEEU sharing across the previous 28 days.
Related terms
- Block download policy
Restricts a single site or OneDrive to view-in-browser access, configured with PowerShell as part of SharePoint Advanced Management. People can't download, print, sync, open files in desktop apps or move them elsewhere.
- E1
Microsoft's entry-level enterprise subscription, available under both Office 365 and Microsoft 365 branding. Anyone on it can use Copilot Chat, and SharePoint Advanced Management accepts it as a qualifying base.
- Restricted site creation
Lets admins decide which apps or security groups may set up new sites in SharePoint and OneDrive. It is part of SharePoint Advanced Management and needs that Plan 1 add-on; Copilot licences alone don't unlock it.
- SharePoint admin center
The console used by SharePoint Administrators to look after sites, sharing across the organisation, storage and versioning, along with the SharePoint Advanced Management capabilities.
- Site access review
Admins choose sites from a data access governance report and email the owners, asking them to check for oversharing (for example through sharing links or EEEU access) and put it right. Owners then mark the review complete and can leave comments. Part of SharePoint Advanced Management.
- Site lifecycle management
A set of SharePoint Advanced Management policies covering site ownership, inactive sites and site attestation, which alert owners and carry out chosen actions so that sites stay owned, in use and necessary. None of them deletes a site outright.