In the tenants I've worked with during and since Ignite, the Ignite 2024 Copilot announcements have shifted how people talk about Copilot governance. The main news is that starting in early 2025, SharePoint Advanced Management (SAM) will be included with every Microsoft 365 Copilot licence. That removes the price barrier that kept a lot of organisations from tightening up sharing and permissions. If you've been fighting oversharing in SharePoint and OneDrive and couldn't get clear visibility into who has access to what, you now get the tools without paying extra or bolting on complicated add-ons. Anyone planning a broad Copilot rollout should take this as a reason to rethink how they manage information exposure across the whole tenant.

Every Copilot licence will include SharePoint Advanced Management

So far, SharePoint Advanced Management has been an optional add-on, and it rarely survived the project budget discussion. That excuse no longer works. As the entitlement rolls out, every user with a Microsoft 365 Copilot licence gets the full SAM feature set. This includes tenant-wide reporting, visibility into external sharing, automated guest access reviews and new controls to restrict anonymous and risky sharing patterns. The last point matters most to me. I've watched plenty of project teams go quiet when they finally see the real picture of their external links and permission chains, and that moment usually kicks off a sensible clean-up.

Pro tip: As soon as SAM is live, go to the SharePoint admin center → Policies → Sharing controls, enable "Monitor external sharing" and set up a periodic review process. Oversharing doesn't go away on its own, so you need to keep watching it.

Microsoft also announced a "Copilot deployment blueprint for oversharing" at Ignite. It helps you map permission sprawl, identify sites at risk and plan a consistent rollout path. I covered related ground in my earlier post on Restricted SharePoint Search and Copilot oversharing.

New oversharing controls and Copilot Actions keep AI responses safe

Copilot is only as trustworthy as the data it can reach, and in many tenants that data is scattered everywhere or shared externally. Beyond the extended SAM controls, Ignite 2024 adds tenant-wide options to standardise sharing policies, restrict anonymous links and detect risky permissions. On top of that, Copilot Actions let admins decide which core actions Copilot is allowed to trigger. If you want automated workflows to stay safe and predictable, that control is important.

The feature I find most useful is the updated DLP for Microsoft 365 Copilot, which is currently in preview. It lets you explicitly block Copilot from using files with sensitivity labels in its responses. If you're responsible for both data protection and AI, this addresses a real headache. Licensing-wise you need Microsoft 365 E5 or equivalent Purview licensing, plus Microsoft 365 Copilot. Here's an example DLP rule (set up in Microsoft Purview → Data Loss Prevention, as Information Protection Administrator):

{
  "Name": "Copilot DLP - Block Labeled Files",
  "ContentContainsSensitivityLabel": true,
  "Action": "BlockCopilotResponse"
}

Created in Microsoft Purview → Data Loss Prevention, role: Information Protection Admin.

Purview DSPM for AI maps and monitors how Copilot touches your data

What used to be called "AI Hub" is now Purview Data Security Posture Management for AI (DSPM for AI). It gives you an end-to-end view of how AI, Copilot included, interacts with your data. In large tenants nobody really knows which files, chats or prompts are feeding sensitive content into AI, let alone which shadow AI apps are doing it. DSPM for AI analyses the data flows, flags risky paths and shows your exposure in an actual dashboard, for Microsoft's own AI as well as connected AI services.

Don't expect useful insights straight away, though. Purview discovery and sensitivity labelling need to be in place and properly tuned first (see https://learn.microsoft.com/en-us/purview/ai-microsoft-purview). Once that groundwork is done, the dashboards start paying off and show admins where Copilot and other AI tools come into contact with sensitive information.

Copilot gets new analytics, SharePoint agents and a Teams interpreter

Every customer eventually asks how to measure Copilot's business value and its risks. The new Copilot analytics features give a proper answer, with usage metrics and prompt analysis right in the admin center (Reports → Copilot usage). IT will appreciate this, and so will works councils that want transparency about where AI helps and where it causes problems. If you want more on adoption and licence assignment, have a look at my post on Copilot usage reports.

There's also significant news on agents. Copilot agents in SharePoint are now generally available for production use. Teams interpreter agents were announced as a preview for early 2025, and they suggest that AI-based meeting translation and assistance will soon be standard. For admins, this means rollout planning has to cover governance for these new bot-like helpers as well.

The diagram below shows how licensing, features and governance fit together in a typical rollout with the new Ignite 2024 Copilot controls:

flowchart TD
    Licence["Copilot licence"] --> SAM["SharePoint Advanced Management"]
    SAM --> Oversharing["Oversharing controls"]
    Licence --> DLP["Copilot DLP rules"]
    Licence --> Analytics["Copilot analytics"]
    Licence --> Agents["Copilot agents"]
    Licence --> DSPM["Purview DSPM for AI"]

Figure: How the new Ignite 2024 Copilot features relate to each other and support admin control.

My takeaway is that a Copilot rollout is now a governance project

After the Ignite 2024 Copilot announcements, I no longer see a Copilot rollout as technical setup plus some user training. It's a full governance and data protection project that involves both IT and leadership. Now that SharePoint Advanced Management comes with every Copilot licence, there's no remaining obstacle to tackling sharing and permissions properly. And with Purview DSPM for AI and Copilot DLP, there are finally concrete answers to the privacy and compliance concerns that, to be honest, held back Copilot adoption in many organisations until now.

My advice to admins is to review and update your sensitivity labels, refresh your DLP rules and schedule regular sharing reviews. Also make sure Purview is configured well enough that the new dashboards reflect your actual data landscape. Do that, and Copilot has a good chance of delivering the value you expect without opening you up to new risks.