What to take away
Microsoft 365 Copilot grounding and the authenticated SharePoint knowledge path in Copilot Studio respect the user’s source permissions. This does not establish the identity or permissions used by an agent’s tools: record whether each connector uses end-user or maker-provided credentials. Residual oversharing is usually yesterday’s broad groups, Everyone except external users (EEEU), inherited folders, and agent knowledge or connector scopes that still match those ACLs. Policies that block prompts or hide sites from discovery are interim or complementary controls—not proof that access was narrowed. Treat agent publishing, knowledge URLs, connectors, and agent sharing as their own review objects, with owners and dated verification separate from “we enabled DLP for Copilot.”
1. Separate chat Copilot, Studio agents, and file-link problems
Three situations get conflated in SMB conversations:
Microsoft documents that Copilot references content the signed-in user is already authorized to access. For the documented SharePoint knowledge option with user authentication, an agent surfaces only content the user can read—returning “no response” rather than unauthorized text when access is missing. That is necessary and incomplete: if fifty people already have Read on a sensitive library, Copilot and agents will treat that as legitimate grounding until permissions change.
Related: SharePoint external sharing for audience and discovery controls; Anyone with the link for link inventory; Shadow AI when the tool is outside the approved tenant path.
| Surface | Typical question | What this guide expects you to verify |
|---|---|---|
| Microsoft 365 Copilot chat | Can Copilot summarize a folder that half the company can open? | Current permissions and group membership on that content |
| Copilot Studio / custom agents | Which sites, lists, and connectors can this agent use, and who can run it? | Knowledge URLs, authentication, connectors, agent Editor/Viewer sharing |
| Drive / SharePoint links | Is this Anyone or guest link still live? | Link and sharing remediation (see related guides—not repeated here) |
References: Add SharePoint as a knowledge source (Copilot Studio)
2. List agents and knowledge sources before you trust the policy pack
Start with a short inventory—spreadsheet is enough for most SMBs:
Microsoft’s Copilot Studio guidance asks admins to restrict GenAI publishing where needed, apply Power Platform data policies to connectors and authoring abilities, and limit agent sharing (for example caps on viewers and blocking broad security-group assignment when that fits your risk). Record what your tenant actually allows today; a policy PDF is not an inventory. Review maker-provided tool credentials separately from SharePoint grounding. An environment-wide change to end-user credentials can break autonomous or background agents that have no user present; assess affected workflows before changing that control.
For SharePoint knowledge, register only the site or folder URLs required. Agents search the registered URL and its subpaths—they do not crawl parent or sibling sites through hyperlinks inside documents. Over-registering “the whole Intranet” recreates the same oversharing problem inside the agent definition.
- Agent or Copilot experience name, environment, and business owner
- Knowledge sources (SharePoint site/list URLs, files, other grounded sources) and date recorded
- Connectors and actions the agent can perform (mail, files, tickets, custom APIs)
- Who can use it (Viewers) and who can edit or publish it (Editors / makers)
- User authentication mode and, separately, each tool’s runtime identity (end-user or maker-provided credentials); no-authentication agents do not retrieve this SharePoint knowledge path
- Last review date and known gaps (licensing, SAM, Purview edition)
References: Add SharePoint as a knowledge source (Copilot Studio) · Control maker-provided tool credentials
3. Residual risk after DLP-for-Copilot and Restricted Content Discovery
Microsoft’s governed Copilot foundation pairs oversharing remediation with guardrails: Restricted Content Discovery (RCD), Purview DLP for Copilot, and durable permission fixes (excess groups, company-wide links, broken inheritance, site owners).
Keep expectations honest:
SMB trap: enabling the policy layer while EEEU, stale guests, and “Company” links remain on high-value libraries. Keep interim protections only with an owner and exit condition. Record which SAM/Purview features your edition actually includes versus manual owner interviews.
- RCD can exclude eligible SharePoint sites from Copilot discovery. Permissions and direct access remain. A missing answer is not proof a permission was removed.
- DLP for Copilot can constrain grounding or prompts for labeled/sensitive content. It does not rewrite ACLs or revoke agent connectors.
- Permission remediation is what changes who can open the file—and therefore what Copilot or an agent can ground on for that user.
References: Configure a secure and governed foundation for Microsoft Copilot
4. Review connectors and agent actions as a separate blast radius
SharePoint grounding is one risk. An agent that can send mail, create records, or call write-scoped connectors is another. In Material Security’s sample of 22,332 apps across 21 Google Workspace environments, 91% of AI/automation apps were first observed since January 2024; 1,064 apps had live tokens and no current active users. This is sample evidence, not an Elba or Microsoft tenant estimate.
For each agent connector or related Entra grant: name purpose and data; cut unused write/mail scopes; review grants on maker offboarding and agent decommission, separately from sign-in; verify the provider’s actual effect. Google suspension resets that user’s OAuth tokens, while other-user grants and tenant consent need their own review. In Microsoft, deleting a delegated grant prevents new tokens for those permissions; existing access tokens can remain valid until expiry. Pair with the third-party OAuth audit so Studio agents, Graph consents, and browser-observed AI tools are not three disconnected lists.
References: OAuth Risk Report summary · Control maker-provided tool credentials · Identify and secure compromised accounts · Delete a delegated permission grant
5. Test residual paths with synthetic content and named identities
On an enrolled account with known permissions, run three dated tests:
Also check whether a Viewer can publish edits and whether guests reach the agent against policy. Allow for discovery lag; re-test before closing. Log classifications and config notes—not raw customer content.
- Authorized grounding — synthetic file the user can read; confirm intended Copilot/agent use works.
- Unauthorized grounding — remove access (or use a second identity); confirm no useful content. A “no answer” is incomplete if another group or link path remains.
- Policy boundary — synthetic labeled/sensitive prompt that should hit DLP-for-Copilot or your block; record warn, block, or allow.
References: Add SharePoint as a knowledge source (Copilot Studio)
6. Close with owners, cadence, and what leadership should see
Report three columns, not a single green “Copilot secured” flag:
Cadence suggestion for a 50–200 person org: monthly new-agent and new-knowledge review; quarterly connector and high-risk site permission sample; offboarding checklist that includes agent Editor rights and related grants. Link account-level decisions to your user access review checklist.
- Permissions fixed — sites/items with verified audience changes
- Agent controls — agents inventoried; knowledge and connectors reviewed; sharing limited
- Policy residual — RCD/DLP exclusions still temporary; open exceptions with owners and next dates
How Elba supports this workflow
With the separate Data Protection connection enabled, Elba can surface supported SharePoint and OneDrive sharing exposures and eligible permission-related findings so owners can act without treating a directory sync as document coverage. Third-Party Apps brings connector-confirmed grants into an application inventory alongside distinct browser observations. Configured Browser Security Playbooks apply warnings or blocks in supported enrolled-browser journeys. Coverage must be checked for the actual provider, composer, account and file format: a Microsoft Copilot web result does not establish native Microsoft 365 grounding or Copilot Studio connector protection. Text inspection is bounded; PDFs, Office files, most images and archives are metadata-only. Incomplete inspection is not itself an upload block. These controls do not replace Microsoft’s authoring policies or Purview DLP-for-Copilot.
Elba does not claim to inventory every Copilot Studio agent configuration or to replace SharePoint Advanced Management. Coverage and remediation depend on each deployed connection and supported action. Validate representative findings in the Microsoft source before you treat a row as closed.
Copilot and M365 agent residual-risk checklist
Your checks stay on this page and reset when you reload it.
Common questions
Does Microsoft 365 Copilot bypass SharePoint permissions?
No. Microsoft states that Copilot uses content the user is authorized to access. Investigate audiences that are broader than the business need; ordinary retrieval of accessible content is not a permission bypass.
We enabled DLP for Copilot—are we done?
No. DLP-for-Copilot and Restricted Content Discovery constrain processing or discovery. They do not, by themselves, remove excess group access, stale guests, or over-scoped agent connectors. Finish permission and agent reviews with source verification.
Do Copilot Studio agents respect SharePoint ACLs?
For SharePoint knowledge sources configured with Microsoft authentication, Microsoft documents security trimming: users need at least Read access, and inaccessible content yields no results rather than an error. Register narrow URLs, limit who can use and edit the agent, and still remediate oversharing on those sites.
What should we measure monthly?
Count new agents and knowledge sources reviewed, high-risk sites with verified permission changes, connector grants revoked or restricted with source confirmation, and open exceptions with owners—alongside any DLP or discovery policy changes.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.