m365-oversharing

Name: m365-oversharing
Author: vinayaklatthe

161stars34forks

How to install m365-oversharing?

vinayaklatthe/microsoft-security-skills/m365-oversharing

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill m365-oversharing

Installs into the current project.

Summary

Guidance for remediating oversharing across Microsoft 365 (SharePoint, OneDrive, Teams, Exchange) using the Secure & Governed Data Foundation blueprint - a three-pillar program (remediate oversharing, set up guardrails, meet regulations) built on SharePoint Advanced Management da

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Oversharing Remediation
2
3	Oversharing - content shared more broadly than it should be - is the root cause of most data
4	exposure in Microsoft 365 and the biggest risk amplified by AI. Microsoft's **Secure & Governed
5	Data Foundation blueprint structures remediation into three pillars: remediate oversharing,
6	set up guardrails, and meet regulations**. The work is powered by SharePoint Advanced Management
7	(SAM, included with a Microsoft 365 Copilot license), sensitivity and container labels, and
8	Microsoft Purview.
9
10	## When to use
11	Building a secure, well-governed Microsoft 365 data estate - reducing who can reach what across
12	SharePoint, OneDrive, Teams, and Exchange, then keeping it that way with enforceable defaults.
13	Applies whether or not Copilot is in scope; it is the data-foundation work every AI or data
14	program depends on.
15
16	Do not use this skill when the question is purely Copilot rollout readiness framing (use
17	`purview-copilot-oversharing`), monitoring sensitive data in AI prompts (use `purview-dspm-ai`),
18	or designing a tenant-wide DLP program (use `purview-dlp-policy`).
19
20	## The three pillars
21	\| Pillar \| Goal \| Primary levers \|
22	\|---\|---\|---\|
23	\| Remediate oversharing \| Find and reduce existing over-broad access fast \| SAM data access governance (DAG) reports, EEEU cleanup, sharing-link cleanup, Restricted Access Control / Restricted Content Discovery \|
24	\| Set up guardrails \| Prevent regression with enforceable defaults \| Sensitivity + container labels, secure-by-default labelling, default sharing settings, site lifecycle policies \|
25	\| Meet regulations \| Close audit/legal and AI-regulatory gaps \| Purview Audit, Compliance Manager assessments, data hygiene \|
26
27	Rule of thumb: assess -> classify -> restrict -> default-secure -> govern. Skipping the
28	assess (DAG report) step is the most common failure; encrypting everything "to be safe" is the
29	second.
30
31	## Approach
32	1. Assess (DAG reports) - Run SharePoint Advanced Management data access governance
33	reports to find the riskiest sites: "Everyone Except External Users" (EEEU) on too many sites,
34	broadly shared sites, sharing-link sprawl, and permissioned-but-sensitive content.
35	Verify: DAG report ranks top-N risky sites with named owners.
36	2. Apply interim restrictions - For the highest-risk sites, apply **Restricted Access
37	Control / Restricted Content Discovery** as a fast interim guardrail while owners
38	remediate.
39	Verify: a restricted site no longer surfaces in a test user's search/Copilot results.
40	3. Engage site owners - Notify owners with the expected fix; don't strip permissions centrally
41	without owner context - that breaks legitimate collaboration and erodes trust.
42	Verify: owner remediation tickets opened with deadlines.
43	4. Classify & label - Apply sensitivity labels to sensitive content and container labels to
44	sites; reserve encryption for genuinely sensitive content.
45	Verify: a top-tier label encrypts and blocks unauthorised access.
46	5. Secure by default - Use secure-by-default labelling (derive labels from SharePoint
47	sites) and tighten default sharing settings so new content is protected without relying on
48	users to remember to label.
49	Verify: newly created content inherits a default label/sharing scope.
50	6. Govern lifecycle - Apply site lifecycle and inactive-site policies plus access reviews so
51	oversharing doesn't creep back; this is ongoing governance, not a one-time cleanup.
52	Verify: inactive sites archived or owners re-attested on cadence.
53	7. Meet regulations & monitor - Use Purview Audit and Compliance Manager to close audit/legal
54	and AI-regulatory gaps, and monitor for new oversharing continuously.
55	Verify: audit/regulatory assessment shows reducing exposure over time.
56
57	## Guardrails
58	- Remediate before broad enablement of AI/Copilot; a clean, scoped pilot can proceed, but
59	tenant-wide turn-on without asses

People who liked this also viewed

6 picks

Type

m365-oversharing

161stars34forks

View on GitHub

How to install m365-oversharing?

vinayaklatthe/microsoft-security-skills/m365-oversharing

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill m365-oversharing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Oversharing Remediation
2
3	Oversharing - content shared more broadly than it should be - is the root cause of most data
4	exposure in Microsoft 365 and the biggest risk amplified by AI. Microsoft's **Secure & Governed
5	Data Foundation blueprint structures remediation into three pillars: remediate oversharing,
6	set up guardrails, and meet regulations**. The work is powered by SharePoint Advanced Management
7	(SAM, included with a Microsoft 365 Copilot license), sensitivity and container labels, and
8	Microsoft Purview.
9
10	## When to use
11	Building a secure, well-governed Microsoft 365 data estate - reducing who can reach what across
12	SharePoint, OneDrive, Teams, and Exchange, then keeping it that way with enforceable defaults.
13	Applies whether or not Copilot is in scope; it is the data-foundation work every AI or data
14	program depends on.
15
16	Do not use this skill when the question is purely Copilot rollout readiness framing (use
17	`purview-copilot-oversharing`), monitoring sensitive data in AI prompts (use `purview-dspm-ai`),
18	or designing a tenant-wide DLP program (use `purview-dlp-policy`).
19
20	## The three pillars
21	\| Pillar \| Goal \| Primary levers \|
22	\|---\|---\|---\|
23	\| Remediate oversharing \| Find and reduce existing over-broad access fast \| SAM data access governance (DAG) reports, EEEU cleanup, sharing-link cleanup, Restricted Access Control / Restricted Content Discovery \|
24	\| Set up guardrails \| Prevent regression with enforceable defaults \| Sensitivity + container labels, secure-by-default labelling, default sharing settings, site lifecycle policies \|
25	\| Meet regulations \| Close audit/legal and AI-regulatory gaps \| Purview Audit, Compliance Manager assessments, data hygiene \|
26
27	Rule of thumb: assess -> classify -> restrict -> default-secure -> govern. Skipping the
28	assess (DAG report) step is the most common failure; encrypting everything "to be safe" is the
29	second.
30
31	## Approach
32	1. Assess (DAG reports) - Run SharePoint Advanced Management data access governance
33	reports to find the riskiest sites: "Everyone Except External Users" (EEEU) on too many sites,
34	broadly shared sites, sharing-link sprawl, and permissioned-but-sensitive content.
35	Verify: DAG report ranks top-N risky sites with named owners.
36	2. Apply interim restrictions - For the highest-risk sites, apply **Restricted Access
37	Control / Restricted Content Discovery** as a fast interim guardrail while owners
38	remediate.
39	Verify: a restricted site no longer surfaces in a test user's search/Copilot results.
40	3. Engage site owners - Notify owners with the expected fix; don't strip permissions centrally
41	without owner context - that breaks legitimate collaboration and erodes trust.
42	Verify: owner remediation tickets opened with deadlines.
43	4. Classify & label - Apply sensitivity labels to sensitive content and container labels to
44	sites; reserve encryption for genuinely sensitive content.
45	Verify: a top-tier label encrypts and blocks unauthorised access.
46	5. Secure by default - Use secure-by-default labelling (derive labels from SharePoint
47	sites) and tighten default sharing settings so new content is protected without relying on
48	users to remember to label.
49	Verify: newly created content inherits a default label/sharing scope.
50	6. Govern lifecycle - Apply site lifecycle and inactive-site policies plus access reviews so
51	oversharing doesn't creep back; this is ongoing governance, not a one-time cleanup.
52	Verify: inactive sites archived or owners re-attested on cadence.
53	7. Meet regulations & monitor - Use Purview Audit and Compliance Manager to close audit/legal
54	and AI-regulatory gaps, and monitor for new oversharing continuously.
55	Verify: audit/regulatory assessment shows reducing exposure over time.
56
57	## Guardrails
58	- Remediate before broad enablement of AI/Copilot; a clean, scoped pilot can proceed, but
59	tenant-wide turn-on without asses

People who liked this also viewed

6 picks

Type