SharePoint Advanced Management adds enforceable controls for Copilot

In the run-up to Copilot for Microsoft 365 rollouts, the same problem comes up again and again. Tenants lack real data access control, and SharePoint Advanced Management is the piece that's usually missing. Many of the tenants I've reviewed still depend on a patchwork of classic permissions and the occasional report, and simply trust that users won't overshare. Once Copilot arrives, every governance gap becomes visible. Content that was quietly open to ‘Everyone’ is suddenly one prompt away from exposure. That makes proactive controls you can actually enforce more important than ever.

SharePoint Advanced Management does more than produce reports

SharePoint Advanced Management (SAM) is a Microsoft 365 add-on, and it goes well beyond the reporting and audit tools admins already know. If you're preparing for Copilot, the most useful part is that it can limit site access independently of traditional permissions. With the Restricted Access Control Policy you can lock a site down to a specific security group, even if its content was shared more widely before. Users outside the group are blocked, and so are Copilot and search, which can no longer surface the content beyond those boundaries. Microsoft's own documentation (restricted access control) and my earlier post Restricted SharePoint Search: Copilot pilots done right both describe the risks of relying on standard access rules.

Restricted access can be set up in PowerShell or the admin center

Before you can restrict individual sites, you have to enable restricted access control for the whole tenant. You can do that in the SharePoint admin center under “Policies” → “Restrict site access” or with the SharePoint Online Management Shell. Assigning the policy to a specific site then looks like this:

# Prerequisites: SharePoint Online Management Shell, SharePoint Advanced Management licence, Global or SharePoint admin role
# Enable tenant-wide:
Set-SPOTenant -RestrictedAccessControl "Enabled"
# Restrict a site to a security group:
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/SecretProject" -RestrictedAccessControl "Enabled" -RestrictedAccessControlGroups "Contoso\TopSecretSG"

From then on, nobody outside the defined group gets access through external sharing, search or Copilot. That makes it a good fit for sites with highly sensitive content or strict compliance requirements. If you want to add authentication context as another layer of access control, my post Authentication context: Securing sensitive SharePoint sites covers that.

A word of caution: I always recommend rolling the policy out in stages. In many tenants, switching it on too broadly at once has confused users and caused a spike in support tickets, because people suddenly lost access to sites they were used to.

Site access reviews make regular permission checks automatic

Site Access Reviews are another SAM feature worth using. They build on Data Access Governance (DAG) reports and ask site admins to explicitly confirm whether current members and sharing links are still appropriate. For dynamic teams, M&A projects or sites with confidential data, these reviews are the only practical way to keep unwanted permissions from lingering. You set them up in the SharePoint admin center under “Sites” → “Data access governance” → “Access reviews” (see the Microsoft documentation).

Practical tip: I always suggest starting access reviews with sensitive or high-risk sites only. That keeps the admin workload manageable, and both IT and the business units are more likely to accept the process.

Inactive site policies keep stale sites and OneDrives in check

Inactive or abandoned sites and OneDrives are a less obvious risk in tenants with Copilot. SAM's Inactive Site Policies let you define inactivity thresholds that trigger automated actions, ranging from a report to archiving or deleting stale sites. You configure these policies in the SharePoint admin center, and they matter most in mature environments where old sites pile up over time. For OneDrive, comparable central controls make sure personal storage doesn't turn into a forgotten data dump that Copilot or search might come across one day.

Look at current usage patterns before you turn these policies on. In my experience, project sites often sit dormant for months and then become active again, so make sure nothing business-critical gets archived by mistake.

One diagram shows how the controls shape Copilot access

In workshops, people often ask for a visual overview of how these controls interact and what Copilot can and can't reach. Here's a simple diagram:

flowchart TD
    A["SharePoint Advanced Management features"]
    B["Restricted Access Control Policy"]
    C["Site Access Review"]
    D["Inactive Site Policy"]
    E["Restrict OneDrive access"]
    F["Copilot for Microsoft 365 access"]
    A --> B
    A --> C
    A --> D
    A --> E
    B --> F
    C --> F
    D --> F
    E --> F

Figure: How SAM features control Copilot for Microsoft 365 access.

With these controls layered on top of each other, Copilot for Microsoft 365 only surfaces data that is actually meant to be found and used in generative AI scenarios. That improves security, and it lets you sleep a little better.

I consider SAM essential for Copilot governance

What I've seen since Copilot launched is that classic site-level permissions aren't enough on their own. For anyone who wants to control what Copilot can find and use, SharePoint Advanced Management is now a must-have investment. The upfront configuration and the regular reviews take effort, but that effort pays off the first time you catch an oversharing incident before it becomes a leak. If you rely on reports alone, you're already behind. Real governance starts with enforceable policies and ongoing access reviews.

You'll find more practical lessons on Copilot readiness in my article Copilot for Microsoft 365: The real challenge is your tenant and in the official SharePoint Advanced Management docs.