Access & Sharing Governance
This is where the "quick wins" happen. With DSPM showing you oversharing risks, you can now:
- Eliminate Anyone links that expose content publicly
- Reduce external sharing to identity-based authentication
- Apply container labels to SharePoint sites and Teams
- Prepare for Copilot with Restricted SharePoint Search
Complete this section to produce measurable improvements in your DSPM dashboard.
Stale sites are a major oversharing risk. Site lifecycle management (ownership policies, inactive site cleanup) is covered in a dedicated SharePoint guide. Complete it in parallel with this section.
SharePoint Sharing Controls {#sharing-controls}
Harden SharePoint and OneDrive sharing settings to reduce oversharing risk identified in DSPM.
Key Activities
| Activity | Tool | Outcome |
|---|---|---|
| Identify orphaned sites | SharePoint Admin Center | Sites assigned owners |
| Configure sharing defaults | Tenant sharing settings | Balanced security posture |
| Enable site lifecycle | SharePoint Advanced Management | Stale sites cleaned up |
| Restrict external sharing | Per-site policies | High-risk sites locked down |
SharePoint Sharing Levels
| Level | What It Allows | Recommended For |
|---|---|---|
| Anyone | Anonymous links | Not recommended |
| New and existing guests | Authenticated external | Default for most |
| Existing guests only | Pre-approved external | Research collaboration |
| Only people in org | No external | HR, Legal, FERPA sites |
Step 1 – Audit Current Sharing Settings
Click-Ops:
- Navigate to SharePoint Admin Center > Policies > Sharing
- Review tenant-level sharing settings
- Set organization default to New and existing guests (identity-based)
- Disable anonymous links unless specifically needed
PowerShell:
Connect-SPOService -Url "https://yourtenant-admin.sharepoint.com"
# Get current settings
Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType
# Set identity-based sharing as default
Set-SPOTenant -SharingCapability ExternalUserAndGuestSharing
Set-SPOTenant -DefaultSharingLinkType Internal
Step 2 – Harden High-Risk Sites
Goal: Lock down sites containing FERPA, HIPAA, or research data based on DSPM findings.
Recommended Settings for Sensitive Sites:
| Setting | Value |
|---|---|
| Sharing | Only people in your organization |
| Guest access | Blocked |
| Access requests | Disabled or routed to site owner |
| Container sensitivity label | Applied (from Classification) |
DSPM's "Overshared Data" report shows which sites have sensitive content with broad permissions. Start remediation there.
Zero Trust Access Control {#zero-trust}
Implement Conditional Access policies and integrate with Defender for Cloud Apps for session-level controls.
Key Policies
| Policy | Trigger | Action |
|---|---|---|
| Require MFA | Accessing sensitive apps | Block if not MFA |
| Block unmanaged devices | Downloading labeled content | Block download |
| Session control | Accessing labeled files from risky locations | Read-only access |
Copilot Protection {#copilot-protection}
Prepare your environment for safe Microsoft Copilot deployment using Restricted SharePoint Search.
Copilot Readiness Checklist
- DSPM posture score ≥ 70
- Overshared content remediated
- Sensitivity labels applied to sensitive content
- High-risk sites excluded from Copilot indexing
- Pilot group identified
Enable Restricted SharePoint Search
Goal: Prevent Copilot and enterprise search from surfacing content from sensitive sites.
This feature was previously called "Restricted Content Discovery" in Purview. It has been moved to SharePoint Admin Center and renamed to Restricted SharePoint Search.
Click-Ops:
- Navigate to SharePoint Admin Center → Policies → Sharing → Restricted SharePoint Search
- Select Enable site restriction
- Add sites to exclude from search/Copilot:
- HR sites
- Legal sites
- Research data repositories
- Test with pilot users
PowerShell Alternative:
# Requires SharePoint Online Management Shell
Set-SPOTenant -RestrictedSharePointSearch "Enabled"
Add-SPOTenantRestrictedSearchAllowedSite -SiteUrl "https://tamu.sharepoint.com/sites/hr-sensitive"
Validation Checklist
| # | Item | Success Criteria |
|---|---|---|
| 1 | Sharing settings | Tenant default is identity-based |
| 2 | Orphaned sites | All sites have owners |
| 3 | Labels published | Users can apply labels |
| 4 | Auto-labeling | Policies active in simulation |
| 5 | Copilot exclusions | Sensitive sites excluded |
Next Steps
With access controls and Copilot protection in place, proceed to Monitoring to enable visibility and investigation capabilities.