SharePoint, OneDrive & Teams cleanup + Copilot prompt DLP
Microsoft 365 Copilot surfaces any SharePoint, OneDrive, or Teams file an employee already has permission to open, turning forgotten Anyone and org-wide links into instant data leaks. Elba cleans up risky sharing with file owners via Sam and masks or blocks sensitive Copilot prompts across managed browsers without a full-tenant Purview E5 license upgrade.
Trusted by 190+ organizations
Two-layer Copilot protection
Security teams stall Copilot rollouts for two reasons: historical SharePoint and OneDrive oversharing inside Microsoft Graph, and employees pasting sensitive data into Copilot or unapproved AI chats.
Scan SharePoint sites, OneDrive folders, and Microsoft Teams for Anyone links, stale external guest shares, and sensitive PII, PHI, Credentials, Financials, and Confidential documents. Let owners confirm or close access in 1 click inside Microsoft Teams via Sam, with automatic cleanup after your grace window.
Protect Microsoft Copilot in the browser (copilot.microsoft.com, m365.cloud.microsoft/chat, m365copilot.com, and copilot.cloud.microsoft) across Edge, Chrome, Firefox 128+, and Safari 26+. Automatically mask sensitive prompt entities with fictional values (18s fail-closed) or block risky prompts and text/code uploads.
Even when only 20% of employees get paid M365 Copilot seats, the other 80% still open ChatGPT, Claude, or Gemini in the browser. Elba governs all 4 AI assistants plus Microsoft 365 OAuth app grants on Business Premium or E3.
Copilot readiness comparison
Compare cost, deployment speed, and cross-stack coverage for 50 to 2,500 employee Microsoft 365 organizations.
| Readiness dimension | Launch Copilot on raw M365 defaults | Full-tenant M365 E5 + Purview upgrade | Elba Copilot Readiness |
|---|---|---|---|
| SharePoint & OneDrive link sprawl | Copilot surfaces forgotten HR, finance, and legal files to unintended staff | Weeks of sensitivity label taxonomy and PowerShell rule engineering | Fast API scan of SharePoint, OneDrive, and Teams + 1-click owner cleanup in Teams via Sam |
| Stale external guest & Anyone links | External links stay open indefinitely because IT lacks project context | Generates admin-heavy Purview alerts without conversational owner follow-up | Owner verification in Teams/email + automatic remediation after your grace period |
| Copilot browser prompt & upload leaks | Employees paste raw credentials, contracts, and PII into web Copilot chats | Edge-centric policies leave Chrome, Firefox, and Safari gaps | Inline fictional-value prompt masking & blocking on Copilot across Edge, Chrome, Firefox 128+, Safari 26+ |
| Employees without a paid Copilot license | Unlicensed staff paste M365 data into personal ChatGPT or Claude accounts | Purview E5 still struggles with personal accounts in non-Edge browsers | Local work vs personal AI detection + prompt masking across ChatGPT, Claude, and Gemini included |
| Licensing & cross-SaaS economics | High breach and compliance exposure | Expensive tenant-wide E5 step-up that still misses Slack, Drive, and 40+ SaaS apps | Runs on M365 Business Premium / E3 and covers Slack, Google, OAuth, access reviews, and phishing |
3-phase rollout plan
Prepare your pilot cohort in days, then scale safely across the organization.
Connect Microsoft 365, SharePoint, OneDrive, and Teams via OAuth to map public Anyone links, external guest shares, sensitive files, and high-risk Entra OAuth apps before enabling Copilot seats.
Route prioritized file and OAuth checks directly to document owners in Microsoft Teams (or email), and auto-close unaddressed exposures after your grace window.
Push the Elba extension via Intune or GPO to protect Copilot, ChatGPT, Claude, and Gemini prompts with inline fictional-value masking and train employees with AI literacy modules.
Connected workflows & documentation
A closer look
No. Elba connects directly to Microsoft 365 Business Standard, Business Premium, E3, or E5 tenants via official Microsoft APIs and Intune-deployed browser extensions, avoiding a full-tenant E5 upgrade just to clean up SharePoint links and govern AI prompts.
Elba’s managed browser extension enforces account context detection, automated fictional-value prompt masking, prompt blocking, and text/code attachment DLP across copilot.microsoft.com, m365.cloud.microsoft/chat, m365copilot.com, and copilot.cloud.microsoft on Edge, Chrome, Firefox 128+, and Safari 26+ (macOS 26+).
Instead of stripping permissions blindly across every site, Elba scores document sensitivity (PII, PHI, Credentials, Financials, Confidential) and messages the file owner via Sam in Microsoft Teams or email so they can confirm business need or close the share in 1 click, with optional auto-remediation after your grace period.
Yes. Request Elba’s free manual Microsoft 365 exposure check (/exposure-check) to get a prioritized 48-hour snapshot of public and external file links, risky Entra OAuth grants, connected AI apps, and MFA gaps.
Related solutions
Scan 7 cloud DLP sources, run 100-file surgical Google Drive recipient removal, and route 1-click owner fixes via Sam across 4 channels.
Inventory Shadow AI across OAuth and 4 browsers, separate personal vs work accounts locally, and mask or block sensitive prompts in real time.
Enforce inline AI prompt masking, text/code upload DLP, domain blocking, Chrome/Edge extension risk scoring, and bulk-download alerts.
Request your free 48-hour Microsoft 365 exposure report, or book a 30-minute Copilot readiness walkthrough.