The Anatomy of M365 Oversharing: How It Happens
Oversharing rarely happens because of malicious insiders; it is almost always the result of benign convenience. Employees just want to get their jobs done quickly, and M365’s default settings often prioritise seamless sharing over strict security.
- “Anyone” Sharing Links: The infamous anonymous link. When a user generates an “Anyone with the link can view/edit” link, that data is effectively public. If that link is forwarded, leaked, or scraped, anyone on the internet can access it.
- Company-Wide Over-Privileging: Clicking “People in my organisation” sounds safe, but it makes the file searchable and accessible to everyone in the company from the CEO to the summer intern.
- Shadow Teams and Sites: When users create new Teams or SharePoint sites for temporary projects, they often forget to clean up permissions or remove members when the project ends.
- Stale External Guests: Contractors, vendors, and clients are frequently invited into Teams channels. Once their contract ends, their guest accounts often remain active, giving them ongoing access to corporate data.
The Copilot Factor: Fueling the Fire
The rise of generative AI tools like Microsoft 365 Copilot has turned the oversharing problem into an immediate crisis.
AI doesn’t bypass security permissions; it respects them. However, because Copilot can search and surface information across Microsoft 365, it can make previously overlooked or difficult-to-find information much easier to discover.
For example, an employee might have accidentally shared a spreadsheet containing sensitive salary information with everyone in their organisation two years ago. While that file may have gone unnoticed, another employee could potentially discover it through a Copilot prompt if they already have permission to access it.
This makes existing permission gaps more visible and potentially more consequential.
Before expanding AI adoption, organisations need to understand their information security posture and address existing exposure risks. Insentra’s Microsoft Copilot Readiness Assessment helps organisations assess technical readiness, information governance, security and access controls before deployment.
Direct Risks of M365 Data Exposure
| Risk Category | The Security Impact |
| Data Breaches | Sensitive IP, customer PII, or financial records falling into the wrong hands via public links |
| Compliance Violations | Severe fines under regulations like GDPR, HIPAA, or CCPA due to unmonitored data access |
| Ransomware Blast Radius | If an employee’s account is compromised, ransomware can encrypt every file that user has access to including everything overshared with them |
| Intellectual Property Theft | Departing employees or external vendors quietly downloading sensitive data they shouldn’t still have access to |
4 Steps to Secure M365 and Stop Oversharing
Fixing oversharing requires a mix of technical guardrails, continuous monitoring and user education.
1. Tighten Tenant-Wide Sharing Policies
Don’t rely on users to make the right security decisions. Enforce strict defaults at the admin level:
- Disable “Anyone” links entirely if your business model allows it or set them to expire automatically after a short period (e.g., 7 days)
- Change the default sharing link type from “Anyone” or “People in your organisation” to “Specific people.”
2. Implement Data Loss Prevention (DLP) & Sensitivity Labels
Use Microsoft Purview to automatically identify and protect sensitive data:
- Deploy Sensitivity Labels (e.g., Confidential, Internal Only) that automatically apply encryption and restrict sharing based on document content (like credit card or social security numbers)
- Set up DLP policies to block users from sharing files containing sensitive data with external users
Insentra’s Information Protection services can help organisations establish information classification frameworks, implement DLP and strengthen protection across their data estate.
3. Conduct Regular Access Reviews
Data permissions naturally degrade over time. Implement a lifecycle management strategy:
- Automate Microsoft Entra access reviews to force group owners to periodically verify that external guests still need access to their Teams and sites
- Archive or deleting inactive SharePoint sites and Teams that have outlived their purpose
4. Run “As-A-Service” Permission Audits
Because M365 doesn’t provide a single, easily scannable dashboard showing all shared links across the tenant, leverage third-party data security platform (DSPM) tools or robust PowerShell scripting to map out data exposure. Identify your highest-risk files (those containing PII shared publicly) and remediate them first.
Insentra’s M365 Governance service provides ongoing visibility into Microsoft 365 security posture, risky collaboration behaviours and configuration issues, helping organisations maintain stronger governance over time.
The Bottom Line
Oversharing in M365 is an ongoing structural challenge, not a configuration issue you fix once. To adopt modern collaboration and AI tools such as Copilot securely, organisations must move from “open by default” to least-privilege access. The right guardrails help protect sensitive information while keeping people productive.
Don’t let oversharing put your sensitive data at risk. Insentra can help you identify exposure risks, strengthen access controls and secure collaboration across your Microsoft 365 environment.
Contact Insentra to discuss how we can help protect your data without compromising productivity.
