Rencore
Microsoft Purview's new oversharing controls still need third-party validation
Microsoft has expanded Purview's oversharing detection for SharePoint and OneDrive ahead of broader Copilot rollouts. The capability is useful. It is also the same vendor governing the same data, which is a known audit weakness.
Microsoft Purview's expanded oversharing controls, rolled into general availability in February 2026, give SharePoint and OneDrive admins better signal on broadly shared sites and files that Copilot is likely to surface. The functionality is a real step forward, but it leaves the same audit problem every native-only governance posture has: the system reporting on the risk is the same system creating the risk, governed by the same vendor.
Microsoft this month brought a wave of oversharing controls in Purview to general availability, including expanded site-level access reviews, the data security posture management (DSPM) for AI surface, and tighter integration between sensitivity labels and Copilot retrieval. For SharePoint and Microsoft 365 administrators preparing for broader Copilot rollouts, this is genuinely useful. It is also incomplete, in a way that matters for audits.
What changed, in practical terms
Three additions stand out for governance teams.
Site-level access reviews now surface broadly shared sites with risk scoring. Admins can identify sites with “Everyone except external users” or “Anyone with the link” permissions before Copilot ranks their contents high in retrieval. This was previously a manual exercise built on Graph API queries.
DSPM for AI in Microsoft Purview gives a single pane for unprotected data, sensitive data exposed to Copilot, and policy violations linked to AI prompts. It correlates DLP events to specific Copilot interactions.
Sensitivity labels propagate further. Files inheriting a sensitivity label through container labels now have those labels respected more consistently by Copilot’s retrieval pipeline, reducing the cases where a file marked Confidential surfaces in an answer to a user who should not see it.
If you are running M365 E5 or have the requisite Purview add-ons, these capabilities are worth turning on. They are real, and they close real gaps.
What they do not close
The fundamental issue with Purview governing Copilot is structural. Microsoft is the vendor selling Copilot, the vendor running the platform Copilot retrieves from, the vendor scoring the oversharing risk, and the vendor producing the audit evidence. That is convenient. It is also the configuration auditors flag.
Three gaps remain after the February rollout.
No independent attestation. When your CISO asks “prove Copilot did not surface restricted data to the wrong user,” the only evidence is Microsoft’s own logs interpreted by Microsoft’s own tools. Regulated industries (financial services, healthcare, defence) increasingly need separation of duties between the platform and the governance reporting on it.
Limited coverage outside SharePoint and OneDrive. Teams chat content, Loop components, Planner tasks, Stream recordings, and Power Platform data sources all feed Copilot retrieval. Purview’s oversharing surface is still primarily a SharePoint and OneDrive story. The Copilot blast radius is wider than that.
Reactive, not preventive. DSPM for AI shows you what has already happened. Closing the loop, automatically restricting access, archiving stale sites, or revoking sharing links, still requires another layer.
What we recommend for Copilot rollouts in 2026
Use the new Purview controls. Then layer independent visibility on top, for three reasons:
Cross-service inventory. Govern the resources Copilot actually pulls from, including Teams content, Loop, Power Platform, OneDrive, and SharePoint, from a single inventory.
Policy enforcement separate from the platform. Rencore’s 250+ policy templates apply rules that are versioned, exportable, and auditable independently of Microsoft 365 configuration drift.
Automation that closes the loop. Oversharing detection without remediation is a backlog generator. Lifecycle-aware automations archive stale broadly shared sites, revoke “anyone with the link” sharing on labelled content, and route findings to resource owners through the Rencore Teams App.
Purview is doing more, and that is a good thing. Treat it as the data-classification and DLP layer it is genuinely strong at. For service governance and audit-grade evidence across the Copilot retrieval surface, you still need a layer Microsoft does not provide.
See how Rencore governs Copilot retrieval across the full M365 surface, or book a demo.
