SharePoint and Teams security before Microsoft 365 Copilot: 4 profiles, 3 phases

Why Copilot makes oversharing urgent

A site set to "public" three years ago, an "anyone in the organization" link that got forwarded, a guest from a project that ended: until now nobody found them, because you had to know what to look for. Copilot knows how to look. It respects existing permissions, so anything an employee can open can show up in an answer. This is step 2 of our 5 steps to secure Microsoft 365 Copilot, in detail.

What gets created with a site, and why it matters

• A Team Site is created together with a Microsoft 365 Group. Group members are site members, and the group also has an email address.
• A Team in Teams connected to the site uses it as the parent site. A standard channel stores its files in a folder on that same site.
• Private and shared channels each create a separate SharePoint site. A setting applied directly to the parent site doesn't apply to them on its own.

A site sensitivity label: what it controls and what it doesn't

A sensitivity label on a site sets the whole workspace: the site, the group and the team. Through Purview it controls group privacy, whether guests can be added, the external sharing level, access from unmanaged devices (full, web-only or blocked), Authentication Context, and which teams shared channels can be shared with. Through PowerShell it also sets the default sharing link, who can share, and blocking downloads.

What it doesn't do: it doesn't classify the files inside. A file on a "Highly Confidential" site doesn't become Highly Confidential, and when someone downloads it, the protection doesn't go with it. File labels, DLP and retention are a separate layer.

And two traps: switching a label to block guests doesn't remove guests already on the site. And publishing labels to site owners lets them change settings only an admin would normally change, so who gets which label is part of the security design too.

Controls the label doesn't cover

• Restricted Access Control: only members of an approved group get into the site, even if someone else was granted a permission or a link by mistake. Also turn on the setting that blocks sharing with people outside the group, so users see right away that the share won't work. Note: external participants in shared channels aren't checked against RAC.
• Domain restrictions: external sharing only with approved vendors.
• Expiry for guests and Anyone links: vendor access renews only with approval, and anonymous links don't stay open forever.
• No "anyone in the organization" links: such a link works for any employee it's forwarded to.
• Restricted Content Discovery: hides a site from organization-wide search and Copilot while you fix its permissions. It's a temporary control and doesn't change permissions.

These are set separately, by hand or with automation that finds sites by label and applies the rest of the profile. Microsoft doesn't tie them to the label for you.

4 profiles that cover most sites

These are starting points, not Microsoft requirements. You can add profiles, such as one for legal vendors and one for engineering vendors, so that not every approved vendor can reach every sensitive site. Full download blocking is off in every profile: its impact on work is high, so keep it for a specific requirement such as a board site.

3 phases that don't stop the work

1. Label what exists. For each site, collect privacy, sharing level, guests, anonymous links and direct permissions, and match it to the profile that describes what it already does. Apply a label only if it blocks nothing that works today.
2. Harden by actual use. Purview audit logs are kept for 180 days on the standard licence. Check whether guests actually signed in, whether direct permissions were actually used, and whether Anyone links were actually opened. Anything unused for six months is a candidate for removal, and the site moves to a stricter profile.
3. Harden by content. Department heads and Purview classification find sites with sensitive data, such as payroll, customer or legal files, and move them to the strict profile, even if it changes how people work.

Meanwhile, keep new mess out: a required label on every new site, the hardened label as the default, and looser labels published to admins only. An employee who needs a site shared with vendors fills in a short request, and an admin approves it.

Teams: 6 settings worth checking

• Shared channels: creating them and inviting external people are on by default. Turn them off in the global policy and open them with a separate policy only for those who need it.
• Apps: approved apps only, and only for those who need them. Approving an app in Teams isn't approving its Microsoft Graph permissions, which need their own review.
• External cloud storage: turn off every provider you don't use.
• Unmanaged Teams accounts: block them, or let only employees start the conversation.
• Meeting lobby: not "everyone". "People in my org and guests" is a reasonable baseline.
• Channel email: turn it off if you don't use it.

We do all of this in our Copilot security service, as part of our Microsoft 365 security projects.

Sources

• Microsoft Learn: sensitivity labels teams groups sites
• Microsoft Learn: restricted access control
• Microsoft Learn: restricted content discovery
• Microsoft Learn: sharepoint onedrive interact
• Microsoft Learn: audit log activities