Microsoft 365 | Vlad Talks Tech

Copilot in SharePoint FAQ: Your Agents, Skills and Autofill Questions Answered

Vlad Catrinescu — Wed, 21 Oct 2026 15:48:18 GMT

Fellow Microsoft MVP Gokan Ozcifci and I ran over time in our Copilot in SharePoint webinar, probably because I went about 15 minutes over the 20-minute slot he gave me. That left a lot of your questions unanswered, so as I promised at the end, I’ve answered every one of them here. Everyone who registered gets the recording by email, and if you didn’t, you can still watch the recording and get the slides.

Key takeaways

Copilot in SharePoint needs a Microsoft Copilot license (formerly Microsoft 365 Copilot) for each user. General availability started rolling out on September 30, 2026, so it can take a little longer to reach your tenant.
Everyday work, like creating skills and using autofill, is included with that license. Advanced work, like image generation, analytics, real-time autofill and anything at scale, uses Copilot Credits, through a spending policy your admin sets up.
Classic SharePoint agents saved as .agent files keep working until the end of March 2027, and starting in mid-November 2026, you build new agents for SharePoint with Agent Builder.
Copilot in SharePoint runs on a Microsoft-managed reasoning model from OpenAI that you can’t change, but you can pick the model for an agent you build in Copilot Studio.
Autofill columns are library columns that work with managed metadata, and there’s no supported way yet to reuse one in other libraries or sites.
Restricted Content Discovery, which your Copilot licenses unlock through SharePoint Advanced Management, keeps Copilot in SharePoint and agents off a site without changing who can open it.
Copilot in SharePoint isn’t available in GCC, GCC High or DoD yet.

Getting Copilot in SharePoint in your tenant

How do I know when Copilot in SharePoint is available in my tenant?

Look for the Copilot in SharePoint button in the lower-right corner of your SharePoint pages and document libraries. General availability started rolling out on September 30, 2026, and Microsoft’s get started guide for Copilot in SharePoint says the capabilities may appear in your tenant after that date as the rollout progresses. So if you don’t see it yet, don’t worry. As Gokan said during the webinar, it’s still rolling out.

And yes, it’s the paid license. Each user needs a Microsoft Copilot license, and with it the everyday features are included at no extra cost, with no opt-in step. Copilot Credits don’t replace the license either. They pay for advanced work on top of it, which I cover below.

As for the pay-as-you-go option I mentioned in the chat, there’s no pay-as-you-go way to use Copilot in SharePoint without the license. SharePoint agents pay-as-you-go only applies to .agent files, which stop working after March 2027, and Microsoft’s upgrade guidance for agents in SharePoint says it doesn’t apply to Copilot in SharePoint. For autofill columns you set up with Copilot in SharePoint, new files are covered by the Copilot license, even when the library is connected to a pay-as-you-go meter. Pay-as-you-go isn’t gone from Copilot altogether: as the .agent files retire, unlicensed use of agents moves to Copilot app pay-as-you-go.

If you’re an admin, the preview PowerShell settings, KnowledgeAgentScope and its list of sites, are only honored until November 1, 2026. After that, you manage where Copilot in SharePoint shows up with the Site AI settings and Restricted Content Discovery. If you used those settings to limit Copilot in SharePoint to a pilot, or to turn it off, plan for it to appear on every site for every licensed user after that date. If you excluded sites, decide which of them truly need Restricted Content Discovery, because it also hides them from organization-wide search and Copilot responses across Microsoft 365.

Does Copilot in SharePoint work in GCC?

Not yet. Microsoft’s get started guide says GCC, GCC High, DoD, Office 365 air-gapped cloud environments and Microsoft 365 operated by 21Vianet don’t currently support Copilot in SharePoint. Message Center post MC1511052 says it’s coming soon to the government clouds, without a date. Copilot Credits aren’t an option there yet either, because usage-based billing isn’t supported in GCC or GCC High.

Microsoft says the agent changes I cover below also apply to its government clouds, and upgrading to Agent Builder is supported there, though Agent Builder isn’t currently available for declarative agents in DoD. Converting an agent to a skill has to wait until Copilot in SharePoint arrives.

What is Site AI?

Site AI is the settings panel where site owners decide how people use AI on their site, Copilot in SharePoint included. You open it from Settings > Site AI, and it’s the panel I showed in the demo for setting the site’s main agent. From there, a site owner can:

Choose which agent opens from the agent icon in the header, either Copilot in SharePoint or a custom agent.
Hide the Copilot button on site pages for site visitors only.
Turn on advanced document processing, which today means a site admin sharing their own Copilot Credits so autofill uses advanced processing across the site.

On my demo site, Copilot was the main agent and credit sharing was off, so autofill there uses standard processing, which the Copilot license covers.

Hiding the button only applies to visitors, so to take Copilot in SharePoint off a site completely, admins turn on Restricted Content Discovery instead. The main agent choice also has an end date: after March 2027, Copilot is the only main agent a site can have, and Microsoft will remove that setting.

What the Copilot license covers, and when you need Copilot Credits

Does creating a skill cost extra?

No. Creating and managing skills is on Microsoft’s list of everyday work that the Copilot license covers, so a skill like the expense policy check I built in the demo costs nothing extra to create. Whether it uses credits depends on the work it does when it runs. Microsoft calls this a hybrid model, and its get started guide lists the everyday work the license includes:

Asking questions, finding content and catching up
Creating HTML, Word, Excel or PowerPoint files
Creating and editing pages, libraries or lists
Simple rules, approvals and deterministic workflows
Renaming and sharing individual files
Creating and managing skills
Using autofill metadata

Copilot Credits, through usage-based billing, pay for the advanced work:

Working across large or unbounded content sets
Creating entire sites and solutions
Creating and editing files, pages, libraries and lists at scale
Multistep, complex AI workflows, like skills in scheduled AI automations
Real-time autofill metadata
Generating new images and editing existing ones
Analytics on how sites, pages, news and documents perform

That’s the same split Gokan showed on his licensing slide, with his advice on who needs what along the bottom:

The “No user should invest in Syntex” line at the bottom of the slide is only Gokan’s and my opinion. Microsoft hasn’t announced that Syntex is being deprecated, and its pay-as-you-go services are still available under a new name, document processing for Microsoft 365.

Microsoft’s rule of thumb is that credits apply when a job “spans more content than you can work through yourself, needs to run on its own, or has to keep pace as content arrives.”

The 10,000 files I mentioned come from Microsoft’s Copilot Credits Guide, where it’s one of the heavy examples. Its medium examples, like re-tagging the documents in a project folder of 500 files, need credits too. Microsoft doesn’t publish a file count where “at scale” starts. Instead, when a prompt crosses that threshold, Copilot asks you to approve credit use before it continues. If you don’t have credits, it completes what it can and asks you to start a new chat. If you missed my first skills webinar, you can watch the Getting Started with SharePoint Skills recording for the basics.

Your admin turns on the advanced work in the Microsoft 365 admin center under Copilot > Cost management. You add a spending policy, choose all users or specific security groups, select Advanced work in SharePoint under Agents and services, then set limits and alerts and a billing method. If you already have spending policies, review them, because a policy that allows new agents and services as they become available can pick up Advanced work in SharePoint automatically.

Until a spending policy covers you, you only get the everyday work. Even /cost, the command that shows how many credits a task used, isn’t available yet, as I found on my demo site:

Gokan’s advice was to license everyone for the everyday work and give credits only to the people who manage content at scale. Microsoft’s guidance agrees: it prioritizes content managers and site managers, and says most other SharePoint users likely don’t need credits.

Will the prebuilt SharePoint page and list agents need Copilot Credits?

Nothing Microsoft has published ties them to credits, so the answer Gokan and I gave live holds: they need the Copilot license. The SharePoint list agent left the Frontier program and became generally available in February 2026, and it requires a Copilot license. The SharePoint page agent, a Frontier preview, is being retired between mid-October and mid-November 2026, according to Message Center post MC1481325. Gokan mentioned live that Microsoft had deprecated one agent a few weeks earlier, and that notice went out on September 29, 2026.

The same notice says you can keep creating and refining pages and news posts with Copilot in SharePoint. That’s everyday work the license covers, since creating and editing pages, libraries and lists is on the included list. Only doing it at scale needs credits.

Can everyone use an agent I put on a site?

They need either a Copilot license or pay-as-you-go that your admin sets up. With the license, using agents grounded in your organization’s content is included at no extra cost. For people without one, it depends on how the agent was built:

A classic SharePoint agent, the .agent file, uses SharePoint agents pay-as-you-go. Your admin creates a billing policy, and only users in the security group assigned to it can use agents. Microsoft lists the pay-as-you-go price at $0.01 per message, and a successful interaction uses 12 messages.
An Agent Builder agent that uses SharePoint content is billed through pay-as-you-go, consumed as Copilot Credits. Agents like that are off by default for Microsoft Copilot Chat (formerly Microsoft 365 Copilot Chat) users.

As the .agent files retire, Microsoft consolidates unlicensed use under Copilot app pay-as-you-go. For SharePoint content, people need permission to both the agent and the content it uses, so an agent won’t surface a SharePoint file someone couldn’t already open. The exception is files a maker uploads into an Agent Builder agent: anyone who can use that agent can get answers from them.

Does testing an agent in the preview pane use credits?

Not if you have a Copilot license, which is how I tested the Zava Travel Assistant in the demo. Testing an agent is interactive use, and Microsoft includes interactive use of agents by Copilot-licensed users at no extra cost.

Microsoft doesn’t document whether the preview pane in SharePoint, or the Try it tab in Agent Builder, is billed for someone who builds on pay-as-you-go without a license. If that’s you, I’d plan as if a test that reads SharePoint content is metered like any other use.

The only place Microsoft spells it out is Copilot Studio, where testing an agent in the test chat doesn’t consume Copilot Credits for the agent’s own activity. The exceptions are AI prompts or models inside agent flows, and agents built on the GitHub Copilot harness, which bill while you test.

SharePoint agents are moving to Agent Builder

Is a SharePoint agent basically an Agent Builder agent now?

Yes, and from mid-November 2026 that’s exactly what it will be. Today’s SharePoint agents, which I called classic agents in the demo (my naming, not Microsoft’s), are declarative agents saved as .agent files on the site. Microsoft’s upgrade guidance says that starting in mid-November 2026, you’ll use Microsoft Copilot Agent Builder to create agents for SharePoint and OneDrive, and creating an agent no longer saves a .agent file. You still pick SharePoint and OneDrive content as knowledge, and Agent Builder adds sources like Teams chats and meetings, Outlook email and Copilot connectors.

Microsoft’s timeline, which I put on one slide in the webinar, gives you until the end of March 2027 to move your classic agents:

In mid-November 2026, new agents for SharePoint are created with Agent Builder, an Upgrade to Microsoft 365 agent button appears in the builder, and the convert-agent-file-to-skill skill arrives in Copilot in SharePoint.
In November 2026, the Agent Chat web part, which puts an agent’s chat right on a SharePoint page, starts its preview, with general availability planned for January 2027 on the Microsoft 365 roadmap.
After March 2027, .agent files stop responding in SharePoint, Teams and the Copilot app.

There’s no automatic upgrade, so plan each one. An agent that mostly answers questions about its own site can be replaced by Copilot in SharePoint. One that runs a repeatable task becomes a skill, and a named Q&A or retrieval experience becomes an Agent Builder agent. Permissions don’t carry over, because an Agent Builder agent is shared on its own instead of following SharePoint file permissions. Unless the original was shared with everyone in your organization, the upgraded agent starts out private to you, and the .agent file’s usage history doesn’t transfer.

It hasn’t been removed: .agent files keep working until the end of March 2027. My best guess is a change in what the agent icon opens. For Copilot-licensed users, Copilot in SharePoint replaced the ready-made site agent. Unless a site owner picks a custom agent as the main agent in the Site AI settings, Copilot is now the main agent for the site.

Two other things can hide it too: Restricted Content Discovery is turned on for the site, which removes the agent icon from the header, or you don’t have a Copilot license and your organization hasn’t set up pay-as-you-go for agents. And if you mean the Copilot app rather than SharePoint, Microsoft is replacing its Agents entry point with Plugins, and upgraded agents show up in the plugin store.

Does a SharePoint agent get a Microsoft Entra ID, and does it show up in Agent 365?

No to the first, yes to the second. Microsoft’s agent identity documentation says Agent Builder agents currently don’t use or require app registration IDs or Agent IDs. Of the tools in this post, it’s new agents you create in Copilot Studio that get a Microsoft Entra Agent ID automatically. Microsoft doesn’t mention one for classic SharePoint agents either, and their answers depend on each user’s permissions to the agent’s sources.

For admins, agents show up in the agent registry in the Microsoft 365 admin center, under Agents > All agents > Registry. It lists agents with or without a Microsoft Entra agent identity, and SharePoint is one of its agent types. For classic agents, the registry gives you an overview of the agents that have been used in Copilot Chat, and blocking one there only affects its availability in Copilot Chat.

Agent Builder agents, including the ones you’ll create for SharePoint from mid-November, are integrated with Microsoft Agent 365 automatically. Viewing the registry doesn’t need a specific license, while Agent 365’s observability and policy features need Microsoft 365 E7 or an Agent 365 license.

Can an agent answer only from approved documents?

For your readers, mostly yes. People who can read a library but can’t see drafts get the last approved, major version of a file, and SharePoint search doesn’t return files that only exist as a minor version. So a visitor who only sees the published version gets answers from the published version.

The exception is the library’s Draft Item Security setting. If it’s set to “Any user who can read items”, everyone can see drafts, including the account that crawls for search. Editors and approvers can see drafts in the library too, so test the agent with an account that can’t.

For policies, I’d still keep it structural: keep final, approved documents in their own library or folder, keep work in progress somewhere else, and point the agent only at the final location. Someone in the chat suggested adding “only published documents” as a condition in the agent’s instructions. That’s fine as extra guidance, but don’t rely on it, because instructions aren’t a security boundary.

Can I choose the model Copilot in SharePoint uses?

Not in Copilot in SharePoint. Microsoft’s get started guide says it currently runs on a Microsoft-managed reasoning model from OpenAI, that Microsoft selects and manages the model, and that the specific model might change over time. So my answer holds, and I still wish we could choose. Microsoft doesn’t document a model picker for Agent Builder either, because those agents run on the same models Copilot uses.

Gokan’s workaround from the webinar is the one that works today: build the agent in Copilot Studio, add your SharePoint site as knowledge, and select the agent’s model from the dropdown, which includes Anthropic Claude models.

External models have to be turned on in both the Power Platform admin center and the Microsoft 365 admin center, where the Anthropic setting is on by default for most commercial customers outside the EU, EFTA and the UK. Anthropic models are also currently excluded from the EU Data Boundary, so check with your compliance team. Then publish the agent to the Microsoft Copilot app, so you can put it on a page with the Agent Chat web part. Publishing it to the SharePoint channel creates a .agent file, which stops working after March 2027.

Autofill columns

Do autofill columns work with site columns and the term store?

The term store, yes. Site columns, not officially. Autofill works with managed metadata columns, so you can map an autofill column to a term set from your term store, as I showed in my video on autofill columns with managed metadata. Microsoft’s autofill documentation notes that it only uses the first 100 terms of a mapped term set, and when a preferred term or a synonym matches, it saves the preferred term.

Besides managed metadata, autofill supports text, multiple lines of text, number, yes/no, date and time, choice, hyperlink and currency columns. It doesn’t support person or group, location, image or lookup columns.

The autofill column itself is a library column. You write its prompt in that column’s settings, and the values it extracts are saved to the column, so like other column data they can be indexed and used to trigger workflows. As Gokan said, there’s no supported way to reuse an autofill column in another library or site today. The site column workaround I mentioned is real, and the credit goes to Kasper Larsen. He showed how to reuse autofill prompts across libraries that share a content type with PnP PowerShell, building on Leon Armston’s earlier work. It relies on settings Microsoft hasn’t documented, so treat it as unsupported.

Does turning on autofill add the column to every library on the site?

No, only to the library you’re working in. Autofill columns are created one library at a time: Copilot in SharePoint can configure document libraries only, and even when you start from a folder, the configuration applies to that whole library. So keeping autofill in one library is simply a matter of creating autofill columns only in that library, and each column has its own toggle if you want to switch it off later.

In Gokan’s demo, Copilot suggested the columns for the one library he had open, showed a value for each invoice, and asked which columns to keep:

There’s no per-library on switch, because everyday autofill comes with the Copilot license without an opt-in. The controls above the library are broader. Restricted Content Discovery takes Copilot in SharePoint off a whole site, and in the Site AI settings, a site admin decides whether to share their Copilot Credits for advanced autofill. Once that’s on, autofill uses advanced processing whenever it runs on the site.

Can I roll out autofill columns across hundreds of libraries?

Not with anything Microsoft supports today. Microsoft doesn’t document an API, PowerShell cmdlet, site template setting or content type hub option for autofill, so as Gokan said live, you set up the column in each library. In his words, if you have 10 document libraries, you copy and paste the prompt 10 times.

What scales differently is the processing. Standard autofill is included with the Copilot license, and new files uploaded to the library are processed whether or not the uploader has a Copilot license. Real-time autofill metadata, the site-wide processing that keeps pace as content arrives, needs Copilot Credits and usage-based billing turned on for the site. Microsoft doesn’t publish a file count for “at scale” here either.

If you have to do it now, the community has tools. Leon Armston automated autofill columns with PnP PowerShell, and the CLI for Microsoft 365 has a command that sets autofill on a library column. Neither is supported by Microsoft. Leon’s post warns that the API behind it isn’t documented and is subject to change, and he has since noted that the backend APIs changed, so his original script may not work as written. Test carefully before you run anything across a tenant.

If you need the same extraction to run across many libraries in a supported way, Gokan’s slide had the other options: AI Builder models with Power Automate and Power Apps, Copilot Studio, and Azure Document Intelligence in Foundry Tools.

Protecting your content

Can I use SharePoint Advanced Management to keep sites out of Copilot?

Yes. As soon as at least one person in your organization has a Microsoft Copilot license assigned, your SharePoint admins get the SharePoint Advanced Management features included with Copilot. Restricted Content Discovery is the one that does what you’re describing. Copilot reaches your content through Microsoft Graph and the semantic index, which Microsoft builds automatically from your SharePoint content, and it only returns content the person asking can already access. My post on how Microsoft Copilot accesses your work data walks through how that works.

Restricted Content Discovery keeps a site’s content out of organization-wide search and Microsoft Copilot responses, including files people recently worked on. Copilot in SharePoint and AI actions don’t appear on that site at all, and people can’t use the ready-made agent, create agents, or add that site’s content to other agents. It doesn’t change who can open the content, so people who already have access can still open it directly, search within the site, and ask Copilot about a document they have open. You turn it on in the SharePoint admin center from the site’s settings in Active sites, or with PowerShell:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true

The other controls you mentioned are on the same list of features your Copilot licenses include:

Restricted Access Control limits a site to the members of up to 10 groups. People outside them can’t open the site, even with existing permissions or a sharing link, and Copilot and search honor it too.
The block download policy gives a site browser-only access, with no downloading, printing or syncing.
Authentication contexts connect a Microsoft Entra Conditional Access policy to a SharePoint site, which is my best guess at the limited access feature you meant.

Microsoft calls Restricted Content Discovery a temporary governance control and recommends using it selectively, and on sites with more than 500,000 items it can take more than a week to fully apply. My post on SharePoint agent governance shows how to apply it straight from the agent access reports.

Can admins sanitize the HTML that Copilot creates?

Not today, and I haven’t found any sign of it coming: nothing on Microsoft Learn or the Microsoft 365 roadmap mentions an option to sanitize generated HTML.

Microsoft’s support article on HTML pages in SharePoint says SharePoint renders HTML in a sandboxed iframe, with Content Security Policy rules for extra isolation, and blocks arbitrary fetch requests and outbound API calls. JavaScript only runs when it’s contained in the same HTML file, apart from Microsoft-managed versions of a few libraries like Chart.js and Mermaid. External links also need a site admin to add their domain to HTML Field Security. That’s probably why the JavaScript in my expense report didn’t behave in the demo.

The same article answers your tenant question directly: you can’t disallow or restrict HTML pages at the tenant level. Site owners can turn off Allow HTML files in the Site Pages library, and that setting matters more soon. HTML pages, which let you publish an HTML file as a SharePoint page, reach general availability between mid-November and late December 2026, according to Message Center post MC1479517. For the external sharing risk, use the controls you already have:

The site’s external sharing settings
A data loss prevention (DLP) policy using the “File extension is” and “Content is shared from Microsoft 365” conditions
The block download policy on sensitive sites

Sensitivity labels won’t help at the file level, because HTML isn’t one of the file types they support in SharePoint. If a tenant-level option matters to you, send it to the product team as feedback. In the video they recorded for the webinar, they asked us to keep it coming.

What this means for you

Gokan and I focused the webinar on using Copilot in SharePoint, and most of your questions were about what it costs and what’s changing with agents. Both come with dates, so if you’re an admin, put these in your calendar:

Before November 1, 2026, check whether you used the preview PowerShell settings to limit Copilot in SharePoint to a few pilot sites or to keep it off some sites. After that date, Microsoft stops honoring them and Copilot in SharePoint shows up on every site for everyone with a Copilot license, so turn on Restricted Content Discovery early for any site that truly needs to stay out.
Before people start working at scale, decide who gets Copilot Credits and create a spending policy for Advanced work in SharePoint scoped to them. Check whether your existing spending policies already picked it up, too.
Between mid-November 2026 and the end of March 2027, inventory your .agent files with the agent registry, the SharePoint Advanced Management agent reports or search. Then move each one to Copilot in SharePoint, a skill or an Agent Builder agent.

If you’re a site owner or a maker, the rule of thumb from the webinar still applies: use an agent when people need a subject matter expert that answers questions, and use a skill when you have a repeatable process you want Copilot to run. Licensing can decide it too. Skills run in Copilot in SharePoint, so everyone using one needs a Copilot license, while an agent also works in Teams and the Copilot app, including for people on pay-as-you-go:

Start with the classic agents you already have, because those are the ones with a deadline.

Ready to tackle the admin side of Copilot in SharePoint? This webinar was about using it, and on November 12, Microsoft MVP Drew Madelung and I are covering governance: who can create skills and agents, where they live, what they can reach, and which control governs each one. Save your seat for Governing SharePoint Skills and Agents.

Microsoft 365 Archive FAQ: Copilot, Retention, Reactivation and Cost

Vlad Catrinescu — Tue, 20 Oct 2026 15:20:12 GMT

I hosted a Syskit webinar on Microsoft 365 Archive with Trent Green from Microsoft, and it was one of the most active webinars we’ve had in a while. Trent is a Principal Product Manager who has been driving the archive product for the past four years, so I asked him your questions about where archived files go, what your users see and what archiving really costs. Below are his answers, checked against Microsoft’s documentation, plus a few notes of my own.

Key takeaways

Microsoft 365 Archive moves inactive content to a cheaper cold storage tier inside SharePoint, where it keeps its metadata, permissions and compliance settings.
Archived content isn’t used to ground Microsoft Copilot (formerly Microsoft 365 Copilot) and is hidden from search by default, but users can still find it with the Archived filter.
Reactivation is instant for the first seven days, then takes up to 24 hours, and Trent says most files come back in 18 to 22 hours.
Archiving isn’t retention, and your retention policies still apply to archived files, including the ones that delete content.
You only pay for storage above your tenant quota, at $0.05 per GB per month for archived content instead of $0.20, and reactivation is free outside unlicensed OneDrive accounts.
Trent’s advice is to start with about a dozen sites, then scale with SharePoint Advanced Management or Microsoft Purview policies.

How Microsoft 365 Archive works

What is Microsoft 365 Archive?

Microsoft 365 Archive is a new tier of SharePoint and OneDrive storage for your inactive content. Active content still supports everyday collaboration and Copilot, while the archive tier is for data you need to keep but don’t need day to day. Trent gave three reasons to use it: lower cost, more relevant Copilot answers, and general storage management.

It comes as site-level archive, for a whole site, and file-level archive, for individual files on a site that stays active. Microsoft’s overview of Microsoft 365 Archive covers both.

Does archived content leave SharePoint?

No. Trent gets asked that a lot, along with whether you can use an external archive or whether content moves into another repository. Microsoft 365 Archive stays inside SharePoint, within the Microsoft 365 boundary.

It is simply a tiering mechanism.

Behind the scenes, Trent explained, SharePoint moves the content to the cold archive storage Azure offers out of the box, and manages that move for you. Because SharePoint still manages it, your metadata, folder structure, permissions, durability, security and compliance go into the archive and come back out with it.

Does archived content stay in the same country?

Yes. One attendee asked this with GDPR and Quebec’s Law 25 in mind, and Trent’s answer was “Absolutely.” Archived content follows the same geo residency requirements as your active content, and like all SharePoint data, it’s stored twice in different locations, both inside your residency boundary.

It’s not like we’ve shipped it somewhere cheap.

So wherever you agreed your active data can live, your archived data lives in the exact same locations.

Copilot and search

Does Copilot use archived content?

No, and Trent sees that as one of the big benefits. You want Copilot using the most relevant and recent information, so archived content is intentionally left out of Copilot grounding, and Trent said they’re seeing huge results in the relevancy of Copilot’s responses because of it. His team is working on possibly exposing some archived content to Copilot, with admins deciding what’s visible, but today the default is that none of it is.

Apps you build yourself work differently. Archived is a state of a file, so the APIs that list files still return archived files, flagged as archived, but Microsoft’s developer guidance for Microsoft 365 Archive says an app can’t read an archived file’s content until the file is reactivated.

Can users still find archived files in search?

Yes, but archived content is hidden from search results by default to keep things clean, and users opt in per session when they can’t find a file or know it’s archived. In OneDrive search, that’s the Archived filter, and SharePoint search has an Archived option under the File type dropdown. Results are permission trimmed, so people only see archived files they already have access to.

What changes when content is archived

The table below was the first of Trent’s three key takeaways. Compliance, eDiscovery, permissions, security, SharePoint’s extra durability, metadata and versions all stay exactly the same in the archive. Only two things change: archived content is excluded from Copilot grounding, and you have to reactivate it before you can open it again.

Does archiving change a site’s storage quota?

No. Archived files still count against the site’s quota, so a site quota is something archiving can’t get around. If you limit a site to 10 TB, that site gets 10 TB shared between active and archived storage, and the savings happen at the tenant level instead.

How long does reactivation take?

Up to 24 hours, and that’s the fundamental trade-off of archiving. In reality, Trent says most files and sites take 18 to 22 hours, and over 99.9% of files come back within 24 hours. It takes that long because your documents are split into pieces across redundant cold storage, and SharePoint has to fetch them and put each file back together.

The first seven days are the exception: content reactivates almost instantly during its first week in the archive, which helps a lot when someone archives the wrong file.

Do eDiscovery, legal holds and retention policies still work?

Yes. Everything in your Microsoft Purview compliance flows is fully honored, including legal holds, eDiscovery and retention policies you create after the content was archived. Microsoft’s documentation adds that eDiscovery can export straight from archived content, even if the export might take longer, and that sensitivity labels still apply.

Archiving is not retention

Does archiving a file mean it’s retained?

No, and Trent was very clear on this one. Retention policies are fully honored, so a policy can still require a file to be kept, or deleted, after a certain time. Archiving on its own doesn’t keep anything, though, because anyone with permission to delete a file can delete it straight from the archive.

Don’t think of archive as a retention mechanism, but rather just as a storage tier.

Will a retention policy that deletes content also delete archived files?

Yes. An attendee asked whether an auto-delete retention policy, or a label that deletes without review, would skip archived files. Archiving is only a state, so a retention policy that deletes files deletes them whether they’re archived or not, and as Trent put it, you don’t need to worry about archive blocking your retention policy.

File-level or site-level archive

When should I use file-level archive instead of site-level archive?

Use file-level archive when the site is still active, like a team or project site that’s always moving but holds a lot of content nobody uses anymore. You archive those files, and the pages, the lists and the rest of the site keep working.

Site-level archive is for when a project closes all at once. Trent’s example was construction companies, which have to keep a finished project’s files but rarely open them again, so they archive the whole project site in one go. An archived site needs a SharePoint admin to reactivate it, and the inactive site policies in SharePoint site lifecycle management can archive sites for you.

Can I archive a Teams site with private or shared channels?

Not fully, yet. Trent said Microsoft is working on tying this to the archive feature in Teams, so the Teams side and the SharePoint site get archived together. Until then, Microsoft’s documentation says the SharePoint admin center won’t archive a site that has private or shared channels, and PowerShell or Graph archive only the main site.

What archiving looks like for your users

How does a user archive a file?

A user selects the file in a document library and chooses Archive from the list of actions. A dialog reminds them that they can reactivate it instantly for seven days, and that after that, it takes up to 24 hours. The file then stays right where it was, with an archived icon next to its name.

The user needs edit permissions on the file, and the site has to allow file-level archive, which Microsoft’s documentation says is on by default for every site. Admins can turn the Archive action off for the tenant or for specific sites with PowerShell.

What can users do with an archived file?

A lot less than with an active file. To work with its content, they have to reactivate it, but they can still delete it, rename it (to add something like _archived, for example), move or copy it, and see its details. A moved or copied file keeps its archived state, because after the first seven days, it really is in cold storage.

To get a file back, a user selects Reactivate, or just opens the file, and confirms. Anyone with read permissions can do it, it’s free, and nobody has to sign off. After the first seven days, the person who reactivated it gets an email when the file is back, within 24 hours. Microsoft’s end user experience documentation walks through both sides.

Can you archive or reactivate a file on a locked or read-only site?

No. A locked or read-only site doesn’t allow any changes, and archiving is a change. The attendee who asked had actually tested it during the webinar, and got the same answer before Trent did.

Why you can’t archive a folder

An attendee who has used file-level archive since before it was generally available noticed that folders never show the archived icon. That’s by design: only files can be archived, not folders. With site-level archive, getting a single file back means reactivating the entire site, and Trent’s team didn’t want to repeat that problem with folders.

Instead, a folder has an Archive all files action that archives every file under it, subfolders included, so someone who needs one file back reactivates just that file. Trent’s team is exploring an archived icon for folders where every file is archived, but it isn’t on the immediate roadmap, so in the meantime you could rename the folder and add “Archived” in front of its name.

Where admins can see how much is archived

Today, mostly in PowerShell, and only for admins. The ArchivedFileDiskUsed property of Get-SPOSite returns the storage used by the archived files on a site, but it’s in bytes, which isn’t the easiest number to read. Here’s the version I use, which shows it in both MB and GB:

Get-SPOSite -Identity https://contoso.sharepoint.com/sites/projects | Select @{N='Archived (MB)';E={[math]::Round($_.ArchivedFileDiskUsed/1MB,2)}}, @{N='Archived (GB)';E={[math]::Round($_.ArchivedFileDiskUsed/1GB,2)}}

On one of my own sites, the raw property shows 17,241,055,487 bytes, and the version above turns that into 16.06 GB.

It comes from my file-level archive guide on the Syskit blog (I’m Syskit’s technical evangelist), along with the commands that turn file-level archive on or off for your tenant, your sites and new sites.

Trent said the archived gigabytes are coming to the Active sites list in the SharePoint admin center in the next couple of months, and his team is looking at showing site owners how much of their site is archived too.

Start manually, then scale with policies

This is the recommendation Trent’s team gives every customer, because file-level archive is new for your users and they need to learn it before you archive at scale. Customers who’ve had a lot of success did it in three steps:

Start with about a dozen sites whose owners are eager to try it.
Check that their workflows still work the way they expect with archived files.
Once retrieval and the experience work for them, switch to policies.

I do not expect to get to massive scale of archive by having IT admins go click archive on a hundred million files.

Which policies can archive files automatically?

There are two, and on October 8, 2026, they were at different stages, while manual file-level archive itself is generally available.

The SharePoint Advanced Management inactive files policy archives files by their last access date. That’s a brand-new property Trent’s team spent years building, so you only archive files no person is opening. It was coming to public preview (roadmap 573699), PowerShell-only at first, with a threshold of 6 to 48 months of inactivity.
Purview retention-based archive adds an archive step to your retention policies and labels. It fits if you already define your files’ lifecycle with retention, and it was in public preview (roadmap 561208).

Trent said customers are already archiving hundreds of millions of files with these policies, and they haven’t even come out of preview. My SharePoint Advanced Management roadmap post tracks what’s shipped and what’s coming.

Do the policies need extra licenses?

Yes. Manual file-level archive needs no license at all, only pay-as-you-go billing, but both policies need additional licensing, and Microsoft’s documentation lists a Microsoft 365 E5 license for archiving through retention policies.

For the inactive files policy, I asked Trent the question I always get. As an MVP, I can say it: SharePoint Advanced Management has a bit of a funny way to license things, where features made to help you deploy Copilot come with the Copilot license, and other features don’t. Trent confirmed that a Copilot license gives you SharePoint Advanced Management, and that it will include the inactive files policy. My SharePoint Advanced Management licensing Q&A with Microsoft has the background on that split.

What Microsoft 365 Archive costs

Every tenant gets a pool of SharePoint storage, 1 TB plus 10 GB for each eligible license, and Microsoft 365 Archive only bills you for what goes over it. It’s pay-as-you-go, so there’s no license to buy: you enable the pay-as-you-go service and connect an Azure subscription for billing. Reactivation is always free, since Microsoft removed the old site archive reactivation fee on March 31, 2025.

In Trent’s example, you have 1,200 GB in SharePoint and your licenses cover 1,000 GB, so 200 GB is billable. In active storage at $0.20 per GB per month, that’s $40 a month. Archived at $0.05 per GB per month, the same 200 GB costs $10, which is 75% less.

If your total storage were 900 GB, archiving would be completely free, and if you archived 800 GB of your 1,200 GB, you’d still only pay for the 200 GB above your quota. As I said during the webinar, there’s literally no way you pay more by using archive than by not using it: you either save money or pay the same, and you still get the Copilot relevancy. Microsoft’s pricing model for Microsoft 365 Archive has more billing scenarios.

What about OneDrive accounts of people who left?

Those are the one exception to free reactivation. When a OneDrive account becomes unlicensed, for example after someone leaves, it goes into the archive automatically, and since nobody pays for that account, reactivating it costs $0.60 per GB at list price. Trent’s team is also bringing file-level archive to OneDrive, and reactivating files archived in a licensed OneDrive account will always be free.

Should I turn on SharePoint pay-as-you-go storage too?

Yes. Trent said Microsoft 365 Archive is best paired with SharePoint pay-as-you-go storage, because prepaid storage packs lock you into the capacity you bought, so if archiving brings you back under it, you don’t see the savings. With both pay-as-you-go services on, you’re only billed for your overage, at the best blended rate between standard and archived storage.

Microsoft 365 SharePoint Storage, the pay-as-you-go meter for that overage, has been in public preview for commercial tenants since June 2026, and Microsoft plans general availability for November 2026. My post on Microsoft 365 pay-as-you-go updates covers the billing side.

Pay-as-you-go storage also keeps your tenant out of read-only mode. I asked Trent what happens when a tenant goes over its quota without it: after a warning and a small buffer window, the whole tenant goes read-only, and no SharePoint site or OneDrive account can add content.

What this means for you

Trent’s first takeaway was that archive changes access, not governance, so your compliance setup keeps working. His second was to start manually and scale with policies, and his third was that archiving can only save you money. If you’re a Microsoft 365 admin, here’s where I’d start:

Turn on Microsoft 365 Archive with pay-as-you-go billing, and decide which sites show users the Archive action.
Pick a dozen sites whose owners want to try it, and show their users the Archived filter and how to reactivate a file.
Follow both policies through preview, and check which licenses you have for each.
Estimate your savings with Syskit’s free storage calculator, which needs no permissions on your tenant.

Trent’s last piece of advice was to go try it. You can archive a one-megabyte file without any impact on your bill, so play with it and give his team your feedback.

Ready to start archiving? My Microsoft 365 file-level archive guide on the Syskit blog walks through turning on file-level archive, the PowerShell settings that control it, and my recommendations for getting started. Read the file-level archive in-depth guide

Identity Secure Score in Microsoft Entra ID: What to Fix First

Vlad Catrinescu — Tue, 06 Oct 2026 17:17:43 GMT

Microsoft gives every tenant a score for how protected your identities are, and it’s included in every Microsoft Entra ID license. Have you checked yours? It’s called Identity Secure Score, and it’s a lot more useful than a report card, because it ranks every recommendation by how much risk it removes, so you can see which moves are worth the most points.

Key takeaways

Every Microsoft Entra ID tenant has an Identity Secure Score, Free edition included, and you’ll find it right on the home page of the Microsoft Entra admin center.
Each recommendation is worth points based on how much it reduces your identity risk, so the ones worth the most points are the ones to tackle first.
If you only do one thing, require multifactor authentication for administrative roles, because an attacker who gets into an admin account without it is in control of your tenant.
Microsoft recalculates your score every 24 hours, and it can go down as well as up, for example when you add users and don’t secure them properly.
Microsoft Copilot (formerly Microsoft 365 Copilot) answers with whatever each identity can reach, so your identity posture really is your Copilot posture.

What Identity Secure Score measures

Almost every breach we see in the news these days starts the same way, with someone’s credentials getting compromised. But before you can improve your identity security, you need a way to measure it, and luckily for us, Microsoft built a feature that sums up your identity security posture in a single number. That feature is Identity Secure Score, and whether you’re on Entra ID Free or Entra ID P2, your tenant already has one, even if nobody has opened it yet.

Its whole job is to help you decide what to fix first. It ranks every recommendation by how much it would reduce your identity risk, and the bigger the security impact, the more points you get for implementing it. So if, for example, one recommendation moves your score by eight points and another moves it by two, you know exactly which one to tackle first.

How the score updates, and where else it shows up

Your score shows up as a percentage, and Microsoft recalculates it every 24 hours, so when you make a change, you’ll see the improvement within a day. That works both ways, though. Add a new identity without securing it properly, and you can watch your score go down just as quickly.

Your identity score also syncs into Microsoft Secure Score in the Microsoft Defender portal, where it sits alongside the scores for your apps and devices, so your security team gets one view across every pillar. From an Entra point of view, though, this is the score for Entra admins. It’s the full identity picture, the part you can actually do something about, while your security admins in Defender keep an eye on the whole tenant.

Which recommendations have the biggest impact?

The top one is requiring multifactor authentication for administrative roles, at 10 points, and close behind it, at 9, is making sure all your users can complete multifactor authentication. You’ll also see recommendations for a sign-in risk policy, a user risk policy and a policy to block legacy authentication. There are plenty of others, of course, and Microsoft keeps adding and removing them as identity security evolves (and, unfortunately, as hackers evolve too). So it’s worth checking your score often and keeping it as high as you can.

Require multifactor authentication for administrative roles

Ten points is the most Microsoft gives any single recommendation, and for good reason. If an attacker compromises any admin account that isn’t protected by multifactor authentication, and especially a Global Administrator account, they’re now in control of your tenant. So if you only do one single thing after reading this, make it this one.

A sign-in risk policy uses Microsoft Entra ID Protection to automatically challenge sign-ins that look risky, for example by asking for multifactor authentication. ID Protection is also what flags a user signing in from Germany five minutes after they were active in Canada, and unless your users have a teleporter, that’s exactly the kind of sign-in you want flagged.

Protect all users with a user risk policy

If Microsoft finds a user’s credentials leaked on the dark web, a user risk policy automatically makes that user reset their password the next time they sign in.

I think this is a really cool feature, because there are so many sites, forums and credential dumps out there that only dedicated security professionals and hackers know about. You’ve probably never heard of most of them, which is for the best. Microsoft runs a large-scale credential scanning operation that pulls from those sources, from law enforcement and from its own threat intelligence teams, and it checks what it finds against your users’ current passwords in Entra ID. When there’s a match, the policy forces that password reset, so your identities stay protected around the clock. If your users are synced from on-premises, this relies on password hash sync.

Enable policy to block legacy authentication

Legacy protocols, like basic authentication for Exchange, can’t enforce multifactor authentication at all, and attackers know it, so they specifically target those protocols to get around your modern security. This one is worth 7 points, and Microsoft’s own analysis found that more than 99 percent of password spray attacks use legacy authentication protocols.

Identity Secure Score on the AB-900 exam

If you’re studying for the AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals certification, this one is worth your time, because interpreting Identity Secure Score in Microsoft Entra ID is one of the skills measured in Microsoft’s AB-900 study guide. For the exam, remember that Identity Secure Score ranks recommendations by how much risk they reduce, so the bigger the security impact of an action, the more points it adds to your score.

And if you want to know what else to expect on exam day, my AB-900 exam review walks through the question types and the resources I recommend.

Checking the score in a real tenant

You don’t have to go hunting for it. Sign in to the Microsoft Entra admin center, and your Identity Secure Score is right there on the home page, in the Tenant status card at the top right. In my lab tenant, it’s been pretty static at around 46 to 47% for the past two or three months, so clearly I’ve got some homework to do as well.

Select View recommendations, give it a second to load, and you’ll see everything you can do to improve your score. All shows every recommendation, which in my tenant includes security best practices and a few from Microsoft Defender for Identity. The Security filter narrows the list down to the ones that count toward your score.

The first one on my list is Protect your tenant with Insider Risk condition in Conditional Access policy, which brings the insider risk signal from Microsoft Purview into your Conditional Access policies. It needs a Microsoft Entra ID P2 license, and completing it would get me an extra five points, which is pretty cool.

Select any recommendation and you get the full story: its status (Active, in my case), the date it was checked, and the users it affects. Right now, eight out of eight users in my tenant aren’t covered by an insider risk condition in a Conditional Access policy, so the more users I add to that policy, the better my score gets.

Why your score can go down

The second recommendation on my list, Enable self-service password reset, sits at 0.22 out of 1. That looks like a funny score until you open it and see that seven users in my tenant don’t have self-service password reset enabled, which is why I only get part of the point.

Microsoft scores some recommendations all or nothing, and others as a percentage, like the share of your users who are covered, which is exactly where a number like 0.22 comes from (Microsoft’s documentation walks through the math). It’s also why your score can go down. If you add new users and don’t secure them properly, that one point shrinks, because a bigger share of your users is missing the recommendation.

So at a high level, that’s Identity Secure Score: a list of recommendations, plus a score that tells you where your identity security posture stands today and what you can do to improve it in Entra ID.

What this means for you

Microsoft Copilot answers with whatever each identity can reach, so your identity posture really is your Copilot posture. If you want the bigger picture on that, I cover it in why generative AI amplifies the security risks you already have.

So go check your score in the Microsoft Entra admin center today:

Open View recommendations from the Tenant status card on the home page, and pick the Security filter.
If Require multifactor authentication for administrative roles isn’t complete, start there, because that’s the one I’d do first.
Check the Required licenses column before you plan anything, since some recommendations need Microsoft Entra ID P1 or P2.
Come back often, because Microsoft keeps adding and removing recommendations as identity security evolves.

And if your sign-in risk or user risk policies still live in ID Protection, it’s time to move them to Conditional Access, because Microsoft set October 1, 2026 as the retirement date for those legacy risk policies.

Ready to prepare for the AB-900? Identity Secure Score is just one piece of my AB-900 certification path, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. You’ll find this topic in Identify the Core Features and Objects of Microsoft 365 Services, the first course of the full AB-900 path on Pluralsight. And for free resources plus my notes on every skill measured, grab my AB-900 study guide.

AB-650 Exam Review: Where Your Study Hours Should Really Go

Vlad Catrinescu — Tue, 06 Oct 2026 02:57:07 GMT

I took the AB-650 exam while it was still in beta. If I had planned my study time around the exam’s title, I would have studied the wrong things, and that’s the main thing I want you to know before you book it. Of course I can’t share any questions because of the NDA which we should all respect, but in this blog post, I want to share with you where I’d put your study hours and what to expect on exam day.

Key takeaways

The biggest part of the AB-650 is Govern and secure Microsoft 365 tenants and workloads, at 40-45% of the exam, and it’s mostly Microsoft Entra and Microsoft Purview.
For Purview, you need to know how to configure things like DLP policies and sensitivity labels, not just what they do.
Settings for Microsoft Copilot (formerly Microsoft 365 Copilot), Microsoft Agent 365 and SharePoint Advanced Management change fast, so click through them yourself before the exam.
Expect PowerShell, including knowing which older modules Microsoft doesn’t recommend anymore.
If this is your first Microsoft exam, start with the AB-900 and the SC-900.
If you were planning on the MS-102, it retires on November 30, 2026, and Microsoft recommends the AB-650 instead.

What the AB-650 exam really tests

The exam is called Administering Microsoft 365 and AI Services, and passing it gets you the Microsoft 365 and AI Services Administrator Associate certification. Microsoft first announced it as the AI Services Administrator Associate, so you’ll see both names out there. If you read either name and go straight to booking, you’ll walk in expecting a Microsoft 365 administration exam with some Copilot on top.

That’s not really what this is. My exam had a lot of Microsoft Entra and a lot of Microsoft Purview, and not that much Microsoft 365 directly. Everything was still about things that affect Microsoft 365, so it makes sense once you’re sitting there. It’s just not where I would have put my study hours based on the title alone.

And I have to be fair to Microsoft, because the study guide does tell you this. Look at how the exam is split, and Govern and secure Microsoft 365 tenants and workloads is worth 40-45%. That’s the biggest area by far, almost half of the exam, and it’s almost entirely Entra and Purview, with Microsoft Defender for Office 365 in there as well.

Skill area	Weight	What’s in it
Configure and manage Microsoft 365 tenants and workloads	20-25%	Tenant settings, domains, licenses, Microsoft 365 Backup, mailboxes, teams and SharePoint sites
Govern and secure Microsoft 365 tenants and workloads	40-45%	Microsoft Entra identities and authentication, Microsoft Defender for Office 365, Microsoft Purview
Manage and secure AI services in Microsoft 365	35-40%	Copilot settings, agents and Microsoft Agent 365, AI usage and cost monitoring

Even the AI part brings Entra back in, since agents now get their own identities through Microsoft Entra Agent ID. You can see the full breakdown in the AB-650 study guide on Microsoft Learn.

So the information is right there. It’s the exam title and the AI Services Administrator name on the certification that pull your attention toward Copilot and agents, when about half of the exam is identity and data protection.

My advice is the same one I’ve been giving IT pros for years, for every exam. Don’t just look at the title, and don’t just look at the marketing around it. Look at the study guide and at how Microsoft splits the exam, because the two don’t always tell the same story. Study everything, but if you’re going to over-invest anywhere, over-invest in Microsoft Entra and Microsoft Purview.

What I would brush up on

Let’s get a bit more practical. I’m calling out these areas because a lot of Microsoft 365 admins don’t use them day to day.

Microsoft Entra ID

Start with Microsoft Entra ID, and that includes authentication methods and Microsoft Entra Password Protection. Don’t forget that most organizations still have hybrid environments, so you need to know how to configure and manage those too, not just cloud-only scenarios. Password Protection is a good one to practice for that, since you can extend its banned password lists to your on-premises Active Directory with agents on your domain controllers.

Microsoft Defender for Office 365

Next is Microsoft Defender for Office 365. Go play with all the different services inside it, and not just on their own, but also how they integrate with Microsoft Purview.

Microsoft Purview

Speaking of Purview, this isn’t the SC-900, where you just need to know what each product does at a high level. You need to know how to actually configure it: data loss prevention (DLP) policies, sensitivity labels, sensitive information types. Reading about them isn’t enough, so get into the portal and build a few of each.

Copilot and Agent 365 in the Microsoft 365 admin center

This is a big one for the AI part of the exam. You need to know where everything is in the Microsoft 365 admin center for managing Copilot, and for Microsoft Agent 365.

I know what you might be thinking, and I agree: that whole area is brand new and moving fast. That’s how Microsoft ships things today, so remembering a blog post you read three months ago might not be enough. Go click through the admin center yourself before the exam. Microsoft’s study guide even says the exam can include preview features when they’re commonly used.

SharePoint Advanced Management

And don’t forget SharePoint Advanced Management. This is another one where you need to look at the latest, because it moves fast. Restricted Content Discovery, or RCD for short, changed behavior recently. Microsoft announced the change in message center post MC1427972, and the rollout started in late July 2026.

With the new behavior, files you recently accessed on a site with RCD turned on no longer show up for you in Copilot or Microsoft 365 search. Before, if you had recently viewed, edited or shared a file, you could still find it. The update also removes the Copilot button, the AI menus and Create pages with AI from those sites. Some older documentation still describes the old behavior, so make sure you know what changed. I also go deeper on RCD in my post on SharePoint agent governance.

Learn where things live across the admin centers

A broader tip for the entire exam is to learn where things live across the different admin centers. For any given task, know all the places you could configure it, because some settings exist in more than one admin center. Creating a user is the easy example, since you can do it in the Microsoft 365 admin center or in the Microsoft Entra admin center. At associate level, knowing which admin center is best, or which one gives you the option Microsoft is asking about, is an important distinction.

How much PowerShell is on the AB-650?

Because this is an associate exam, you also need to know PowerShell. The PowerShell questions I got weren’t that difficult, but I also spend way more time in PowerShell than the average IT pro, so that might be why they felt easy to me.

At a high level, know which modules you have, how to connect to each service, and what a few commands look like for each module. If you want a quick refresher, these are the main ones:

Service	Module	Connect with
Microsoft Entra ID and Microsoft Graph	Microsoft Graph PowerShell	`Connect-MgGraph`
Exchange Online	ExchangeOnlineManagement	`Connect-ExchangeOnline`
Microsoft Purview (Security & Compliance PowerShell)	ExchangeOnlineManagement	`Connect-IPPSSession`
SharePoint	Microsoft.Online.SharePoint.PowerShell	`Connect-SPOService`
Microsoft Teams	MicrosoftTeams	`Connect-MicrosoftTeams`

You also need to know the past modules. You might get questions where more than one option would work, but some of them use modules that Microsoft doesn’t recommend anymore, like the Azure AD and MSOnline modules that Microsoft Graph PowerShell replaced. So know which modules to use today.

Where to start if this is your first Microsoft exam

If this is your first Microsoft certification exam, or you’re just starting with Microsoft 365 and Copilot administration, I would start with the AB-900 (Microsoft 365 Copilot and Agent Administration Fundamentals) and the SC-900 (Microsoft Security, Compliance, and Identity Fundamentals). They aren’t required for the AB-650, but they give you a lot of the foundation on Microsoft 365, Copilot, Purview and Defender, and you can build up to the associate level from there. My AB-900 study guide and SC-900 study guide have free resources for both.

What to expect on exam day

I can’t share the number of questions on the exam, but Microsoft says most of its exams have between 40 and 60, and you get 100 minutes for an associate exam, or 120 if it may contain labs. For an associate-level exam like this one, expect the more advanced question types too: scenarios, questions where you put steps in the right order (Microsoft calls those build list questions), and pretty much every other question type Microsoft uses. You can try them all in Microsoft’s free exam sandbox.

Is the AB-650 a fair exam?

If I had to give an opinion, I think it’s a really fair exam, and a really fair test of how the job of a Microsoft 365 administrator has changed in the era of AI. For a long time, a lot of us mostly needed to know how to manage SharePoint. Now we need to understand identity better, because identity is the first way people get hacked. We need to understand data protection and Purview. And now we’re governing agents that have their own identities, all on top of the workload administration we already do.

So I think it points people in the right direction, with the right knowledge. Just go in with the right expectations about where the weight actually sits. If you’re a SharePoint, Teams or Exchange admin and you haven’t really touched Purview or Entra ID, learn those before you sit the exam.

What this means for you

If you’re a Microsoft 365 admin, this is the certification that lines up with what the job looks like now. And if you were planning to take the MS-102, keep the date in mind: Microsoft retires it on November 30, 2026, and recommends the AB-650 certification instead.

To get ready, I would go in this order:

Read the AB-650 study guide and check yourself against the Govern and secure section first, since it’s 40-45% of the exam.
In a test tenant, build a few DLP policies, sensitivity labels and sensitive information types, and spend time in Defender for Office 365.
Click through the Copilot and Agent 365 settings in the Microsoft 365 admin center, and read up on the new RCD behavior.
Practice connecting to each service with the current PowerShell modules.
If this is your first Microsoft exam, take the AB-900 and the SC-900 first.

Ready to start studying for the AB-650? My AB-650 study guide covers every skill measured on the exam, with free study notes and resources. And if you want to go deeper on Microsoft 365, Copilot and Purview, check out my 100+ courses on Pluralsight.

SharePoint Skills FAQ: Your Webinar Questions Answered

Vlad Catrinescu — Fri, 25 Sep 2026 04:07:27 GMT

The Teams gremlins held my camera hostage for part of my Getting Started with SharePoint Skills webinar, but the questions kept coming, and I ran out of time before I ran out of questions. This SharePoint skills FAQ answers every question from the Q&A panel and the chat, including the ones I answered live, double-checked against Microsoft Learn and Microsoft’s latest updates. If you missed the live session, you can watch the full SharePoint skills webinar recording on my YouTube channel.

Key takeaways

A skill is not a saved prompt. It’s a shared, multi-step workflow that everyone on the site can trigger in plain English, and Copilot in SharePoint doesn’t have saved prompts anyway.
Skills run when someone asks for them in the Copilot in SharePoint chat. They can’t run on a schedule, on a file event, or from Power Automate today.
Personal skills live in your OneDrive and are for you only. To share a skill with your team, create it as a site skill on the team’s SharePoint site.
You protect skill files like any other SharePoint content: break inheritance on the Agent Assets library, and people with View access can still run the skills.
There’s no official application lifecycle management (ALM) for skills yet, so keep a copy of business-critical skills in a central repository and use PnP PowerShell or Microsoft Graph PowerShell for inventory.
A SharePoint agent answers questions about content. Copilot in SharePoint with skills takes action on that content.
Microsoft just announced that Copilot in SharePoint has hit General Availability and also clarified the billing model!

Skills vs Saved Prompts and Other Tools

Why Is a Skill Different From a Saved Prompt?

Microsoft 365 Copilot does let you save prompts in the Copilot Prompt Gallery from Copilot Chat, Teams, and Outlook, but Copilot in SharePoint doesn’t have saved prompts, so on a SharePoint site a skill is the way to package a request people can reuse. There is some overlap in the idea, since both save you from retyping the same instructions. The difference is everything a skill adds on top.

A skill lives on the site, so everyone with View access can run it. Nobody has to find the prompt in a Notepad file or a OneNote page. People just ask in natural language, and Copilot in SharePoint matches the request to the skill through its description. A skill can also chain several steps, load reference files, and call other skills, so it handles long-running tasks a single prompt can’t.

The biggest difference is consistency. A saved prompt behaves differently depending on who runs it, because each person’s memories and customizations shape the answer. A skill documents the process once, so everyone gets the same steps and the same output. Microsoft’s skills documentation says skills let Copilot in SharePoint perform tasks “more consistently than one-off prompts.”

When Should I Use a Skill Instead of a Power Automate Flow, a Copilot Studio Agent, or a SharePoint Agent?

Use a skill when the work stays inside SharePoint and benefits from judgment: reading documents, classifying them, checking them against a rule, and updating lists or libraries based on what it finds. Skills are no-code, multi-step, and use AI to understand intent, but today they can’t connect to external systems or run custom code. That first limit is about to loosen: Copilot in SharePoint is getting support for plugins from your enterprise store, and a plugin can bundle skills and Model Context Protocol (MCP) servers that connect to other systems. It’s in preview and scheduled to roll out worldwide in December 2026, according to the Microsoft 365 roadmap.

The other three options each fit a different job:

A Power Automate flow is deterministic. It follows the exact same path every time, connects to third-party systems through connectors, and handles formal processes like approvals through Outlook. When the process must never vary, or it has to reach outside Microsoft 365, use a flow.
A SharePoint agent answers questions. It’s grounded in your SharePoint content, but it doesn’t take action on that content.
A Copilot Studio agent is for scenarios beyond SharePoint. Custom engine agents built in Copilot Studio can reach other systems and even trigger actions automatically, without a user asking. They’re also more work to build, deploy, and maintain.

This is exactly the question my October 20 webinar goes deeper on, with scenarios for each option. The registration link is at the end of this post.

Running Skills

Can Skills Run on a Schedule, When a File Is Added, or From Power Automate?

Not today. A skill runs when someone asks for it in the Copilot in SharePoint chat, either with a matching request or by naming the skill. You can’t trigger a skill from a file event, run it on a schedule, or call it from a Power Automate flow.

If what you need is a simple reaction to a file event, SharePoint’s built-in workflows for lists and libraries now cover some of it. In its September 2026 update, Microsoft added workflows that post a Teams message when files are added or metadata changes, and workflows that route approval requests. Those are separate from skills, but they might cover the event-driven part of your scenario.

Is There a Limit to How Many Documents a Skill Can Classify, and Can It Handle 10,000 Files?

I haven’t found a published limit on how many files a skill can process, and I haven’t tested a 10,000-file library myself. I’m checking with the product team and will update this post when I hear back.

What is documented is the usage limit. During the preview, according to the Copilot in SharePoint get-started guide, Copilot in SharePoint applies daily and weekly usage limits to each user. The limits are individual, not shared across your organization, and when you hit one, Copilot features pause until the limit resets automatically. A classification run across thousands of files does a lot of work, so plan for it:

Test the skill on a few selected files first, then on a single folder.
Run large libraries in batches, folder by folder, instead of in one request.
For files that keep arriving, look at autofill columns in SharePoint, which extract metadata as files are uploaded, so you only run the skill once on the backlog.

In the blog post from September 25th, Microsoft has announced the ability to work with Copilot in SharePoint to operate across large content collections, but I do not know yet what large means!

Can a Skill Create Site Pages From a Template and Add Quick Links Web Parts?

Creating pages, yes. Copilot in SharePoint can create pages, and a skill chains Copilot in SharePoint’s built-in capabilities, so page creation can be one of the steps. Whether it can also add and configure a Quick Links web part that points to related pages depends on the page tools available in your tenant.

The quickest way to check is to type --agenttools in the Copilot in SharePoint chat, which lists every action Copilot in SharePoint can run on that site, and look through the page-related tools. The list of tools differs from tenant to tenant, so check yours rather than relying on someone else’s screenshot. Then test the skill on one page before running it across a site.

A skill you create in OneDrive is a personal skill, and personal skills are designed to be yours alone. That’s why you got the message that the skill doesn’t support sharing with everyone who can access the folder. So yes, it comes down to OneDrive instead of SharePoint, though the real distinction is personal versus site scope.

Personal skills are saved as Markdown files in your own OneDrive, under Documents, Copilot, Agent Assets, Skills, and they follow you across every SharePoint site and OneDrive. They’re perfect for your own way of working, like how you want long documents summarized. They rolled out in preview in August 2026 and roll out worldwide in December 2026. Microsoft announced them in its September update, but the Microsoft Learn skills article only covers site skills so far.

To share a skill with your teammates, create it as a site skill instead. Open the Copilot in SharePoint chat on your team’s SharePoint site and create the skill there. It’s saved to that site’s Agent Assets library, and everyone with View access to the site can run it.

How Do I Protect the Skill Files in the Agent Assets Library?

You protect them the same way you protect any other SharePoint content. By default, anyone with Edit permission on the site can create a skill, and anyone with View permission can run one, which means every member of a team site can change the skill files. If you want a tighter model, Microsoft’s documentation points you to breaking permission inheritance on the Agent Assets library and applying more restrictive permissions.

In practice, that means giving members Read on the Agent Assets library and keeping Edit for the owners and the few people who author skills. Members can still run every skill, because running a skill only needs View access. Retention, sensitivity labels, and auditing apply to skill files too, and the library keeps version history, so you can roll a skill back if someone breaks it.

You already spotted the trade-off: once members can’t edit the library, they can’t create skills on that site anymore. The same library holds your SHAREPOINT.md file, so locking it down protects your site context too. The library also holds a Plans folder, so after you change the permissions, sign in as a member and run a skill to confirm everything still works the way you expect.

Governance and Lifecycle Management

Can I Maintain SKILL.md Files With Azure Pipelines in Azure DevOps?

Not officially, and I’ll be honest, this is one of the more disappointing parts of the preview. Skills are managed at the site level, and Microsoft doesn’t offer a supported way to deploy or update them from a pipeline.

In the meantime, a few things help:

Version history. Skills are files in a document library, so every change is versioned and you can restore an earlier version.
Built-in skills that improve your skills. Microsoft ships built-in skills to create, check, and improve skills. In September 2026 they added measured evaluations, where Copilot suggests tests, evaluates the current results, and recommends changes before you share a skill more broadly.
A preview of what’s coming. When you type /skills, the list includes a section for enterprise skills. It was empty in my tenant during the webinar, but it shows where Microsoft is heading for centrally managed skills.
Plugins from your enterprise store. A plugin can bundle skills, and an admin can install it tenant-wide, so once plugin support rolls out you’ll have a governed way to distribute the same skills across sites.

Until then, my recommendation is simple: when a skill becomes business-critical, keep a copy in a central repository you control. That gives you a source of truth even without an official process.

Until Enterprise Skills Arrive, Is PnP PowerShell the Way to Govern Skills?

Yes. Since skills are Markdown files stored in each site’s Agent Assets library, PnP PowerShell works well for building an inventory: loop through your sites, look in the Skills folder of the Agent Assets library, and each subfolder with a SKILL.md file is one skill. Microsoft Graph PowerShell works too. Auditing also applies to skill files, the same as other SharePoint content.

I can’t wait for Microsoft to give us proper governance for skills. Governance for SharePoint skills and agents would make a great future webinar topic too.

SharePoint Agents vs Microsoft 365 Copilot Agents

Every SharePoint site comes with a ready-made agent that answers questions based on that site’s content. People with Edit permission can also create custom agents, which are saved as .agent files in the site’s Site Assets library, scoped to the sites, folders, or files you choose, and tailored with your own instructions.

Custom agents don’t automatically appear in any list, so you share them like any other file. People can open the .agent file, and you can also share a SharePoint agent in Teams group chats and meetings. Site owners also decide what opens when people select the agent icon, either Copilot in SharePoint or a custom agent, and access always follows the site’s permissions.

Keep in mind that SharePoint agents answer questions, while Copilot in SharePoint is the experience that runs skills and takes action. My step-by-step guide to creating SharePoint agents walks through building one.

Is a SharePoint Agent the Same as an Agent Created in Microsoft 365 Copilot?

No. A SharePoint agent lives in its SharePoint site and only uses SharePoint content. An agent you build with Agent Builder in Microsoft 365 Copilot can use knowledge from SharePoint, Teams, Outlook, public websites, and Microsoft 365 Copilot connectors, and you can share it across the organization or submit it to your organization’s catalog.

Where you build it depends on where the content lives and what the agent needs to do:

Build it in SharePoint when the content lives on one site and the audience is that site’s members.
Build it with Agent Builder when the agent needs content from several places, like Teams and Outlook as well as SharePoint. My guide to building Copilot agents with no code in Agent Builder covers the basics.
Build it in Copilot Studio when the agent needs to take actions in other systems or run without a user asking.

Agent Builder agents can do a lot more, but they’re also a bit more work to maintain and deploy.

What This Means for You

Most of these questions come down to the same thing: skills are still a preview feature, and the parts around them, like scheduling, lifecycle management, and governance, haven’t caught up yet. That doesn’t make them less useful today. It means you should be deliberate about where you use them.

If you’re an admin, decide who can edit the Agent Assets library on your important sites before skills spread, and start keeping business-critical skills in a central repository now. If you’re a builder, pick one repetitive task that stays inside SharePoint, build it as a site skill so your whole team can use it, and test it on a small set of files before pointing it at a large library.

Ready to take SharePoint skills further? On October 20, Microsoft MVP Gokan Ozcifci and I are running a free webinar on automating content in SharePoint with Copilot, covering more advanced skills, SharePoint agents, and autofill, and when to reach for each one. Save your seat for the October 20 webinar.

SharePoint Advanced Management Roadmap: Shipped and Coming

Vlad Catrinescu — Tue, 01 Sep 2026 00:28:24 GMT

SharePoint Advanced Management (SAM) has grown into a full content governance suite for Microsoft 365, with its own AI assistant on top. This post tracks the SharePoint Advanced Management roadmap against Microsoft’s own documentation. You will see what has actually shipped, what Microsoft has said is still coming, and what each part means for you.

This roadmap check is accurate as of August 2026. Roadmap items move quickly, so status and dates can change after this date. Where something is documented, I link to Microsoft Learn. Where it is not, I attribute it to the product team and date it.

Key takeaways

The SharePoint Admin Agent is live. It answers governance questions in plain language and needs the new SharePoint Advanced Management Administrator role.
Catalog management, the content management assessment, and item-level oversharing reports have all shipped and are documented on Microsoft Learn.
Two things Microsoft framed as “coming” have since shipped: Microsoft Agent 365 (generally available since May 1, 2026) and the mid-2026 feature wave.
Some pieces are still on the way, including a site owner governance experience (name not final), catalog-scoped policies, and sensitive info type data in the permission report.
Licensing matters. SAM needs a Microsoft 365 Copilot license, the SAM add-on, or Microsoft 365 E7. Microsoft 365 E5 on its own gives you reporting only.

What SharePoint Advanced Management can do today

Most of the roadmap is already real. Here is what is documented and available right now.

The SharePoint Admin Agent

The headline feature has shipped. The SharePoint Admin Agent is an AI-powered governance assistant that reasons over your SharePoint and SAM data. You ask a question in plain language, and it returns analysis and guided remediation. You can open it in the Microsoft Copilot app, in the SharePoint admin center, or in Microsoft Teams.

Where to start: the content management assessment

Not sure where to begin? Run the content management assessment. Open Advanced Management in the SharePoint admin center navigation pane and select Start assessment. SAM then runs a suite of reports and flags the sites that need attention.

The assessment covers five areas: inactive sites, site ownership, broken inheritance, sharing with Everyone except external users, and overly permissive sharing links. Microsoft recommends rerunning it every 30 days.

One caveat on timing, because two different reports quote different windows. The assessment page lists a run time of 2 to 72 hours, depending on tenant size. The separate site permissions snapshot report is slower. Microsoft says its first run can take up to 5 days, regardless of tenant size. Either way, start early and do not expect instant results.

Catalog management: structure your sites

Catalog management has shipped, including the custom options. It groups your sites into categories and groups. That structure then lets the SharePoint Admin Agent give more targeted insights instead of reasoning over everything at once.

Out of the box, catalog management builds categories from Microsoft Entra ID and SharePoint metadata, such as department and locale. These refresh every hour. You can also build your own categories three ways:

CSV upload: create curated categories with up to 20 groups each.
Custom site property: point SAM at a site property, such as a cost center, and it creates one group per value. This option covers up to 20,000 sites.
Microsoft Entra ID extension attributes: group sites by the values in extension attributes 1 through 15.

One gap is worth noting. Catalog management groups SharePoint sites, and the documentation does not mention SharePoint Embedded containers.

Oversharing reports and the new admin role

The permission state report is still the flagship oversharing tool. The bigger news is file-level reporting. A new report, Sites and files shared via special SharePoint groups, has shipped. It lists the items shared with Everyone except external users (EEEU) or Everyone. It is a downloadable export of up to 1 million rows, not a dashboard.

File-level data comes with a stricter security model. The SharePoint Advanced Management Administrator role is required to run these reports. It is a superset of the SharePoint Administrator role. Even a Global Administrator cannot view file properties across sites they do not own without it.

Two more oversharing tools are live. Site access reviews let you ask site owners to fix overshared sites, up to 100 sites per request, and up to 1,000 reviews a month from the organization-wide permissions report. Restricted Content Discovery removes AI entry points, such as the Copilot button and agent creation, from a site. You can also delegate it to site administrators.

Agent access insights

Agents now leave a trail across your content, and you can see what they touch. The agent access insights report lists the agents reaching your SharePoint and OneDrive content. You find it in the SharePoint admin center under Reports, then Agent insights, for the past 1, 7, 14, or 28 days.

The report covers SharePoint agents, declarative agents, and custom agents. From the report, you can act right away by applying Restricted access control or Restricted Content Discovery to a site.

Resilience: settings and backup

Resilience is the newest pillar, and the agent surfaces most of it. Ask the agent whether Baseline Security Mode is enabled, and it returns a status. Ask about recovery options, and it reasons over your Microsoft 365 Backup state.

Multi-Geo, in preview

Multi-Geo has a start, but it is still preview. On Microsoft Learn, the agent’s cross-geography content move prompts are marked as preview. They let you check the status of cross-geo moves and find libraries that need to move.

What’s still coming on the SharePoint Advanced Management roadmap

The rest of the list is not documented yet. These points come from Dave Minasyan, the Principal Product Manager who leads SAM at Microsoft, in our 2026 conversation. I am reporting them as his statements at the time of recording, not as shipped features. As someone who has presented on SAM at conferences for years, I would treat this section as direction, not dates.

A storage card in the assessment. Dave said storage analysis is coming to the content management assessment. Today the assessment documents five reports, and storage is not one of them.
SharePoint Embedded containers in catalog management. Dave said onboarding containers to SAM is in progress. It is not documented yet.
Catalog-scoped policies. Dave described scoping lifecycle policies to a catalog category. The policy documentation still lists other scopes only.
Batched emails and a site owner governance hub. Dave described batched emails, one for lifecycle and one for oversharing, plus a single hub page for site owners. He added that the governance hub name is not final. Microsoft documents per-report tailored emails today, not the batched model or the hub.
Sensitive info type in the permission report. Dave said Microsoft is working with Purview to bring sensitive file type data into the permission state report. Note one nuance: the site-level sensitivity label already appears in the report. The file-level sensitive info type integration is the part still coming.
Deeper agent insights. A heat map view and richer agent owner details are still developing.
Cross-workload governance. Dave said Microsoft wants to bring content governance context to Teams and Exchange admins. It is not documented yet.
A growing agent skill set. Dave said the agent’s skills will keep expanding. The specific counts he shared are not documented, so I am leaving numbers out.

Two things that shipped since this was recorded

Roadmap content dates fast, and this conversation is a good example. Two things Dave described as coming have since shipped.

First, Microsoft Agent 365. At the time of recording, Dave described it as “going to be coming in.” Microsoft Learn now states that Microsoft Agent 365 is generally available as of May 1, 2026. It is a separate product from the SharePoint Admin Agent, and it acts as a control plane to observe, govern, and secure agents.

Second, the mid-2026 wave. Dave pointed to a June, July, and August release window. That window has effectively closed, and the named items landed inside it. Catalog custom groups and the item-level oversharing report are both documented and live today.

Licensing and availability: what you actually need

The roadmap conversation skips licensing, so here are the details from Microsoft Learn.

You need a qualifying base subscription first. That means Office 365 E3, E5, or A5, or Microsoft 365 E1, E3, E5, or A5, or a government plan.

Then you unlock SAM one of three ways, per the prerequisites:

at least one Microsoft 365 Copilot license assigned in the tenant,
the SharePoint Advanced Management Plan 1 add-on (on a SharePoint K, P1, or P2 plan), or
Microsoft 365 E7, also called the Frontier Suite.

Microsoft 365 E5 on its own is not enough for the full suite. Microsoft documents this clearly. An E5 admin without Copilot gets data access governance reporting only. There are no snapshot reports, no remedial actions, and activity reports return up to 10,000 sites.

Sovereign clouds are supported, with gaps. Microsoft 365 operated by 21Vianet does not support data access governance reports or site access reviews, even with the required licenses.

Finally, plan for the role. The SharePoint Advanced Management Administrator role is a superset of the SharePoint Administrator role, and it gates file-level reporting. Even Global Administrators must assign the role before file-level reports will run.

What this means for you

Start with the free wins. Run the content management assessment if you have SAM. It is one click, and the results guide everything else. Because it can take up to 72 hours, start it early and put a monthly rerun on your calendar.

Next, plan your structure. Sketch catalog categories that match how your organization works, and clean up your Microsoft Entra ID department attributes so sites do not pile into an “other” bucket. Good structure makes every report and policy more precise.

Then sort out access and licensing. Decide who gets the SharePoint Advanced Management Administrator role, since file-level reports will not run without it. Confirm which license path unlocks SAM for you, and check the E5 and 21Vianet limits if either applies.

One last habit for roadmap content: treat status as a moving target. Two items in this very conversation shipped before this post went live. Re-check Microsoft Learn before you promise a feature to your organization.

Want the full walkthrough of each feature? I broke down every part of the 2026 wave in my guide to what’s new in SharePoint Advanced Management. I also covered the licensing model in my SharePoint Advanced Management licensing Q&A with Microsoft. For the agent governance side, see my recap of Agent 365 from the ESPC keynote. To keep up as the roadmap ships, subscribe to the Vlad Talks Tech newsletter at vladtalkstech.com.

SharePoint Content Resilience: Backup, Archive & Multi-Geo

Vlad Catrinescu — Tue, 01 Sep 2026 00:06:16 GMT

SharePoint content resilience comes down to one question: when something goes wrong with your content, can you get it back? Microsoft answers with a small stack of features. Now it is wiring them into the SharePoint Admin Agent, so you can reason over them in plain language.

In Part 8 of my SharePoint Advanced Management 2026 series, Microsoft’s Dave Minasyan walked through where this is heading. Dave is a Principal Product Manager at Microsoft. This post is the standalone version. As a Microsoft MVP who works in these tenants every day, I will keep it practical. You will learn what each piece does, what it costs, and where the limits are.

Key takeaways

Microsoft defines content resilience as Baseline Security Mode, Microsoft 365 Backup, and version history. Archive and Multi-Geo sit next to it under lifecycle and data residency.
The SharePoint Admin Agent can now check Baseline Security Mode and surface recovery options in plain language. The Multi-Geo prompts are still in preview.
Backup and Archive are pay-as-you-go and need an Azure subscription. Multi-Geo is a separate paid add-on with a five percent minimum.

What SharePoint Content Resilience Means

Content resilience is the protection side of content governance. In other words, it is how you keep content safe, recoverable, and in the right place. Microsoft Learn is specific about the term. On the SharePoint Admin Agent page, content resilience means three things: Baseline Security Mode, Microsoft 365 Backup, and version history.

Two other features come up in the same conversation. Microsoft 365 Archive is technically part of content lifecycle, not resilience. Multi-Geo is filed under data residency compliance. I cover all of them here because they answer the same real question. How do you protect and control your content? Still, it helps to know how Microsoft groups each one. Each is also licensed very differently.

The SharePoint Admin Agent’s New Resilience Skills

Most of these capabilities already exist in the admin experience. What is new is that the SharePoint Admin Agent can now reason over them. As Dave put it, the team is hooking the resilience areas into the agent. Now you can ask questions instead of hunting through pages.

Microsoft Learn backs this up. The SharePoint Admin Agent page lists content resilience as a supported capability. It also publishes ready-to-try prompts. Two of them are generally available today. The first is “Is Baseline Security Mode enabled in my tenant?” The second is “What recovery options are available for my SharePoint and OneDrive sites?” On camera, Dave described the backup piece as something the team was “building out right now.” By the time of writing, that recovery prompt is already live. So treat it as here, not coming.

The agent also honors your role. On camera, Dave showed that a SharePoint admin sees only the SharePoint state in the agent, not vulnerabilities in another workload like Microsoft Entra ID. That is the agent scoping the view to your role. The Baseline Security Mode page works in a related way. The settings area is visible to several workload admins, but each one can manage only their own settings. Dave also shared some numbers on camera, though he hedged them. He estimated the skill covers around 45 tenant settings today. The team has identified roughly 250 so far, with about 60 data points behind the analysis. Those figures are his estimate, not a documented count, so use them directionally.

Baseline Security Mode, Checked for You

Baseline Security Mode is a set of security settings you turn on in the Microsoft 365 admin center. You find it under Org Settings, in the Security and Privacy tab. That admin center home is why Dave calls this the organizational settings area. It brings settings that used to live only in PowerShell into a single page.

Here is a detail worth knowing. Baseline Security Mode works on all Microsoft 365 subscriptions and plans, so there is no extra license gate. Access is role-based instead. A SharePoint admin manages the SharePoint and OneDrive settings. Other workloads stay with their own admins.

Microsoft recommends a phased approach, and it matches the agent’s report card. First, you run an impact report for each setting. Next, if the report shows zero impact, you turn the setting on. Finally, if critical dependencies exist, you fix those before you commit. The agent is essentially putting a conversation in front of that same workflow.

Microsoft 365 Backup: Point-in-Time Restore

Microsoft 365 Backup gives you fast, point-in-time restore for SharePoint sites, OneDrive accounts, and Exchange mailboxes. It is built inside the Microsoft 365 trust boundary, so your data never leaves it. Backups are append-only. That means the service can add new restore points but cannot alter old ones.

The recovery window is configurable per policy. Your choices are three months, six months, one year, or two years. Existing policies default to one year. Restore points are frequent too. For a full SharePoint site or OneDrive account, you get a restore point every ten minutes for the prior two weeks. File and folder restore points are roughly daily in that window. After that, weekly snapshots run from two to 52 weeks back.

Billing is where people get caught. Microsoft 365 Backup is pay-as-you-go, not a per-user license. At the time of writing, Microsoft Learn lists the rate at 0.15 US dollars per gigabyte per month. Restores are free. Because it is pay-as-you-go, you need an Azure subscription and resource group in the same tenant. You also need a billing policy in the Microsoft 365 admin center. One warning from the docs: only disconnecting the payment method stops billing. Reaching your budget alert does not pause the service. Prices change, so confirm the current rate on Microsoft Learn before you plan a budget.

A few more useful facts. If you ever offboard, a 90-day grace period lets you recover your backups. Microsoft 365 Backup is now available for Government Community Cloud. It also supports Multi-Geo tenants across both central and satellite locations.

Microsoft 365 Archive: Cold Storage That Stays in Place

Microsoft 365 Archive moves inactive SharePoint sites and files into a cold storage tier. Crucially, it keeps them inside SharePoint. The site keeps its metadata, permissions, and searchability, and you can reactivate it later. Microsoft files this under content lifecycle. The site lifecycle management policies in SharePoint Advanced Management can even move sites into the archive tier automatically.

The pricing model rewards cleanup. At the time of writing, archived storage is billed at 0.05 US dollars per gigabyte per month. Standard storage over quota costs 0.20. Better still, the archive meter only charges you once your archived plus active storage exceeds your licensed SharePoint quota. Below that quota, archived data adds no cost. Reactivation of archived SharePoint content is also free now, since Microsoft removed that fee in March 2025. Unlicensed OneDrive accounts are the exception, and they still carry a reactivation charge.

The limits matter too. Some site types cannot be archived, including publishing sites and certain legacy templates. Sites with private or shared Teams channels are only partially supported. You cannot archive them from the SharePoint admin center, though PowerShell or Graph can archive the main site. Certain file types are excluded as well, such as OneNote, SharePoint pages, and SharePoint agents. Finally, once you reactivate content, you cannot archive it again for about four months. Plan around that before you reactivate a large site.

Version History: The Everyday Safety Net

Version history is the resilience feature you already use without thinking about it. It is part of Microsoft’s built-in data protection in SharePoint and OneDrive. When a file changes, you can view a previous version, restore it, or see who changed what.

It is also your first line of defense against small disasters. An accidental overwrite can often be undone by rolling a file back to a clean version. The same is true for many ransomware changes. Backup handles the big recovery scenarios, while version history handles the everyday ones.

Multi-Geo: Keeping Data in the Right Country

Multi-Geo lets one Microsoft 365 tenant store data in multiple geographies to meet data residency needs. A user’s data lives in a preferred data location, and admins manage it all from a single tenant. In the episode, Dave showed the agent starting to track geo moves. So when someone changes countries, you can follow the move from one place. The related agent prompts for cross-geo moves are still in preview, so treat that tracking as early.

Licensing is the big catch here, because Multi-Geo is a separate paid add-on. You buy it through an Enterprise Agreement, Web Direct, or CSP. It layers on specific base plans, such as Microsoft 365 F1, F3, E3, E5, and E7. Equivalent Office 365, SharePoint, OneDrive, Exchange, and Teams plans also qualify. Small Business plans do not. There is also a minimum. Enterprise Agreement and CSP customers must buy Multi-Geo for at least five percent of their eligible users. One more note from the docs: tenants that use Multi-Geo fall outside the EU Data Boundary scope.

Licensing and Availability, Product by Product

This episode is the trickiest in the series for licensing, because each piece is billed differently. Here is the short version.

First, the SharePoint Admin Agent itself needs SharePoint Advanced Management. That means a qualifying base plan, plus one of three things. You need a Microsoft Copilot license, the SharePoint Advanced Management Plan 1 add-on, or Microsoft 365 E7. The agent itself requires the SharePoint Advanced Management Administrator role.

After that, the resilience features are on their own terms. Baseline Security Mode is included on all plans. Microsoft 365 Backup and Microsoft 365 Archive are pay-as-you-go. So they need an Azure subscription and a billing policy, not a license tier. Multi-Geo is the separate add-on described above.

Government and sovereign clouds are a mixed picture, so check your own environment. Microsoft Learn documents Backup and Archive for commercial and Government Community Cloud tenants. It does not list them for GCC High, DoD, or the 21Vianet cloud in China. So do not assume coverage there. Multi-Geo is offered in the commercial geographies listed on Microsoft Learn. The sovereign clouds are not part of that list.

Bring Resilience Into Your Governance Plan

SharePoint content resilience is not a single product. At its core, it is Baseline Security Mode, Backup, and version history. Archive and Multi-Geo sit close by, and the SharePoint Admin Agent is starting to tie them together. Start by confirming what you actually have licensed. Then decide which gaps are worth closing.

If you want the bigger picture, my guide to the five pillars of Microsoft 365 content governance puts resilience in context. To automate the move of stale sites into the archive tier, see SharePoint site lifecycle management. And for everything the suite added this year, read what is new in SharePoint Advanced Management for 2026.

SharePoint Site Access Reviews: A Practical Guide

Vlad Catrinescu — Tue, 01 Sep 2026 00:05:04 GMT

SharePoint Site Access Reviews solve a genuinely hard governance problem. As an admin, you can see that a site is overshared. However, you usually cannot see the files inside it. You also rarely know whether that broad access is a real problem or just how the team works. The people who do know are the site owners. SharePoint Site Access Reviews, a feature of SharePoint Advanced Management, let you hand the cleanup to those owners. Better still, you never look at their file-level content yourself. In this guide, I break down how the reviews work, what the site owner sees, and the limits to plan around.

Key takeaways

Site Access Reviews let IT admins delegate oversharing cleanup to site owners, who review and update permissions on their own sites.
In a site access review, admins do not see file-level or item-level detail, which keeps it inside compliance boundaries.
You can start reviews for up to 100 sites from the web view, and PowerShell handles anything larger.
Reviews cover SharePoint sites only, not OneDrive, and are unavailable on Microsoft 365 operated by 21Vianet.
Restricted Content Discovery and Restricted Access Control are sibling controls, and both can be delegated to site admins.

What Are SharePoint Site Access Reviews?

A SharePoint Site Access Review hands a data access governance report to a site owner for cleanup. In other words, the admin flags a potentially overshared site, and the owner does the actual work. The feature lives in the SharePoint admin center, under Data access governance.

The design answers two problems at once. First, compliance rules stop IT admins from seeing the file-level or item-level details in these reports. Second, site owners understand their own content far better than any central admin could. As a result, the owner is the right person to decide who keeps access.

Having worked with SharePoint environments for over a decade, I can tell you this is a meaningful shift. For years, oversharing cleanup landed entirely on the admin. Now the workload moves to the people closest to the data.

Why Delegate Reviews to Site Owners?

The honest answer is scale. I recently sat down with Dave Minasyan, a Principal Product Manager at Microsoft who leads SharePoint Advanced Management. He put it plainly. Many organizations run one SharePoint admin for a thousand users, or even hundreds of thousands. One person cannot know who should access every site.

Delegation fixes that imbalance. The admin still decides which sites need attention. However, the owner makes the call on individual files and permissions. Dave framed the goal as scaling the admin, not replacing them. The admin stays the pivotal person who directs the work, while owners handle the details.

How a Site Access Review Works

The admin side is straightforward. First, sign in to the SharePoint admin center. Next, expand Reports and select Data access governance. Then choose a supported report, select the sites you want reviewed, and select Initiate site access review. Finally, customize the email and send it.

Microsoft documents these supported reports for reviews:

Sharing link reports (Anyone, People in your organization, and Specific people shared externally)
Content shared with “Everyone except external users”
Oversharing baseline report using permissions

Two limits matter here. You can start reviews for up to 100 sites directly from the web view. For a larger batch, you use the Start-SPOSiteReview PowerShell command instead. In addition, one report has a monthly cap. The “Site permissions across your organization” report allows up to 1,000 reviews per calendar month.

Each request becomes an email tailored to the specific issue. For example, a review for the “Everyone except external users” report focuses only on that concern. Dave described the batching benefit well. Instead of fifteen separate emails for fifteen sites, an owner receives one consolidated request. He also noted that the notifications are grouped by category. As a result, an owner typically gets one email for oversharing and one for lifecycle, rather than a flood. Microsoft’s docs confirm the per-report tailored email; the category grouping is how Dave described it.

Once you send a review, you track it from the My review requests tab. The status stays “pending” until the owner finishes. After completion, the reviewer’s name and a timestamp appear. If the owner’s email is invalid, the review is marked as failed.

The Site Owner Experience and the Governance Hub

When a review starts, the site owner receives an email with a link to a detailed review page. That page is scoped to the exact issue the admin flagged. The owner never has to hunt through the whole site.

On that page, the owner can act in two areas. First, they can review SharePoint groups to see which ones contain “Everyone except external users.” Then they remove that group where it does not belong. Second, they can review individual files, folders, and lists shared broadly in the last 28 days. A Manage access button lets them remove users, adjust group membership, delete links, and change permissions. When the work is done, the owner selects Complete review, adds comments, and submits. Those comments flow back to the admin automatically.

Microsoft also gives owners a single place to see everything asked of them. It is called the Site reviews page. Owners reach it two ways: from the review email, or from the site’s gear icon under Site settings. From there, they handle multiple pending reviews in one view.

This consolidated page is what Dave and I call the “Governance Hub” in the video. It is worth being precise here. Microsoft does not brand it that way today. In fact, Dave was candid that the name is not final. So treat “Governance Hub” as a useful shorthand for the owner’s consolidated review experience, not an official product name.

Site Access Review Limits You Should Know

Every governance feature has edges, and this one is no exception. Plan around these documented limits before you roll it out:

SharePoint sites only. Site access reviews currently do not support OneDrive accounts.
The 100-site web cap. You start up to 100 reviews from the web view, then move to PowerShell for more.
No file-level view in the review. Compliance keeps IT admins out of file-level and item-level detail here, which is exactly why owners run the review.
Not available on 21Vianet. Microsoft 365 operated by 21Vianet does not support site access reviews, even with the required licenses.
SharePoint Advanced Management license required. Site access reviews depend on it.

How Site Access Reviews Fit with RCD and RAC

Site Access Reviews are one part of controlling content access. Two policies sit alongside them: Restricted Content Discovery (RCD) and Restricted Access Control (RAC). They solve related but distinct problems, so it helps to keep them straight.

Restricted Content Discovery keeps a site’s content out of organization-wide search and Microsoft 365 Copilot discovery while you review it. It also removes AI entry points from the site. Examples include the Copilot button and the option to create agents or pages with AI. Importantly, RCD does not change permissions. People who already have access keep it, and RCD does not remove content from the search index. Think of RCD as protection that buys you time. The content stays usable for the right people, yet it will not surface in those experiences until you are ready. One caveat: the setting propagates across the index, so it is not instant. For very large sites, above 500,000 items, full effect can take more than a week. RCD applies to SharePoint sites only.

Restricted Access Control takes the stronger step of gating who can open a site at all. You point RAC at one or more groups, either Microsoft Entra security groups or Microsoft 365 groups. You can add up to 10 groups per site. People outside those groups cannot open the site or its content, even if they previously had a direct permission or a link. Members still need their own content permission as well. Search and Copilot honor the boundary too, though on large sites they can take time to reflect the change. One more gotcha: a policy on a Teams-connected site does not automatically cover its shared or private channel sites, which are separate site collections that need their own configuration. In short, RCD hides content from discovery, while RAC controls who can reach it.

Both controls can also be delegated to site admins, which matches how the review model works. RCD is the clearest example. An admin turns on delegation with a tenant setting, Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. After that, site admins manage the setting for their own sites and provide a justification for each change. This delegation is the feature Dave highlighted at the end of the interview. He noted it starts from PowerShell, which is accurate. The tenant toggle is a PowerShell command, while the per-site control lives in the UI.

Automating Reviews with the SharePoint Admin Agent

The SharePoint Admin Agent adds a conversational layer over all of this. It requires the SharePoint Advanced Management Administrator role. With it, an admin asks questions in natural language. One example: “Which sites are overshared and what are the risk levels for these sites?” The agent then gathers the data, offers analysis, and recommends next steps. Microsoft lists controlling access to content, including site access reviews, among the governance tasks the agent supports.

Dave went further and shared where this is heading. He described a future where the admin starts a review through the agent. The agent understands the intent behind it, and then helps the site owner take action. He also mentioned extending the agent to site owners. Those are roadmap ideas from the interview, not documented capabilities today, so treat them as direction rather than fact.

One design principle is worth calling out, because it explains the guardrails. Dave was clear that the agent runs “on rails.” It will not perform destructive actions like deleting sites. Archiving, on the other hand, is supported, because you can reverse it.

The archive numbers back that up. Microsoft 365 Archive keeps a newly archived site in a “Recently archived” state for seven days. During that window, reactivation is instantaneous. After seven days, reactivation can take up to 24 hours. On top of that, Microsoft eliminated the SharePoint reactivation fee on March 31, 2025. Reactivating an archived site is now free. Two caveats apply. Re-archiving reactivated content is blocked for four months. Also, the free reactivation does not extend to OneDrive accounts. So archive is a safe, reversible cleanup lever, which is the point Dave made.

Licensing and Availability

Licensing trips people up, so let me be specific. SharePoint Advanced Management needs one of these base subscriptions:

Office 365 E3, E5, or A5
Microsoft 365 E1, E3, E5, or A5
The GCC, GCC-High, and DoD equivalents

You then unlock SharePoint Advanced Management in one of three ways. First, assign at least one Microsoft Copilot license in the tenant. Second, add the SharePoint Advanced Management Plan 1 add-on to a SharePoint K, P1, or P2 subscription. Third, use Microsoft 365 E7, the Frontier Suite, which includes Copilot. For E3 and E5 tenants, the Copilot add-on is the usual route.

There is one nuance worth calling out. An admin with Microsoft 365 E5 alone can access Data access governance reporting. However, the other SharePoint Advanced Management features stay locked. In that E5-only state, you get no snapshot reports and no remedial actions. Activity reports also return up to 10,000 sites. In practice, full Site Access Reviews need SharePoint Advanced Management, not E5 by itself.

Finally, the 21Vianet exclusion is broad. All three features are unavailable on Microsoft 365 operated by 21Vianet: Data access governance reports, site access reviews, and Restricted Access Control reports. That holds even when the required licenses are present.

Where to Go Next

Site Access Reviews are the collaborative side of content access governance. They pair naturally with the reports that find oversharing and the policies that contain it. As a Microsoft MVP who works with organizations on their rollouts, I’ll keep my advice simple. Start with a small set of sites. Learn the owner experience, then scale.

Want to get your tenant Copilot-ready? Start with the reports that surface the risk, then delegate the cleanup with Site Access Reviews. For the bigger picture, read three related posts. My overview covers what is new in SharePoint Advanced Management for 2026. You can also read the five pillars of Microsoft 365 content governance and where to begin with a SharePoint content assessment.

SharePoint Agent Governance: Monitor and Control Access

Vlad Catrinescu — Tue, 01 Sep 2026 00:04:37 GMT

SharePoint agent governance is not about switching agents on and off. It is about controlling what your agents can reach once they exist. That distinction trips up almost every admin who opens the agent reports for the first time. Microsoft’s own product team goes out of its way to correct it. Here I cover the two reports that share a menu, what each one measures, the policy levers you have today, and where those levers stop working.

Key takeaways

SharePoint Advanced Management governs what agents can access. Agents in SharePoint do not require activation, so there is no per-agent on switch in SharePoint itself.
Two different reports sit under Reports > Agent insights. One counts agents created, the other tracks agents accessing content. They read different audit events and use different cmdlets.
The agent access report shows the top 100 sites, and the top 20 agents for any single site. Downloaded reports scale to 1 million sites.
Two policies apply directly from the report: Restricted Content Discovery and Restricted Access Control. Restricted Content Discovery works on SharePoint sites only.
You need SharePoint Advanced Management either way. If your entitlement comes from a Microsoft Copilot license rather than the add-on SKU, you must also switch on audit data collection before any report will run.

What SharePoint agent governance actually controls

Start with the boundary, because it explains everything else. SharePoint Advanced Management does not turn agents on or off. It governs the content those agents can reach.

Dave Minasyan, Principal Product Manager at Microsoft, stopped mid-demo to make this point. Customers kept misreading the report:

I want to emphasize the fact that we are not managing agents in the sense where you can turn on off an agent in SharePoint. What we’re managing is what these agents can have access to.

Microsoft documents that agents in SharePoint do not require activation, so there is no per-agent switch inside SharePoint. There are still user-level controls, though, and they are easy to miss. You govern who can use agents through Microsoft Copilot license assignment. Admins can also turn the Microsoft Copilot for SharePoint service plan off for an individual user. That disables agents in SharePoint for them, along with Copilot in OneDrive and SharePoint page authoring. Organizations on pay-as-you-go billing scope access through the security group attached to the billing policy instead.

Separately, there is a block control in the Microsoft 365 admin center, under the Agents section of the Copilot Control System. That area was formerly known as integrated apps.

Blocking behaves differently depending on how the agent was built, and Microsoft’s two pages read differently on this. The SharePoint documentation says flatly that blocking affects only availability in Copilot Chat, and does not yet apply to OneDrive, SharePoint, or Teams. The Microsoft 365 admin center documentation is narrower. It scopes that Copilot Chat limit to agents created in SharePoint or Microsoft Foundry, and says blocking an Agent Builder or Copilot Studio agent also reaches Outlook, Teams, and other Microsoft 365 apps. Assume the Copilot Chat behavior for agents built in SharePoint, and test before relying on it elsewhere.

Dave’s mental model for the rest is simple. It is his framing rather than a Microsoft definition:

The way I look at agents is essentially it’s just another type of a file.

This is where the documentation gets genuinely confusing, so it is worth slowing down. Two separate reports live under Reports > Agent insights in the SharePoint admin center. Their names are nearly identical. Their data is not.

	Insights report on agents in SharePoint	Agent access insights report
Measures	Agents recently created	How agents access content
Audit signal	FileCreated and FileRenamed events	Reading, searching, and interacting
Where	Reports > Agent insights	Reports > Agent insights > Agent access
Generate with	`Start-SPOCopilotAgentInsightsReport`	`Start-SPOM365AgentAccessInsightsReport`
Download with	`Get-SPOCopilotAgentInsightsReport -ReportId -Action Download`	`Export-SPOM365AgentAccessInsightsReport -ReportId <ReportId> -Action Download`
Answers	Which sites spawn the most agents	Which agents read which sites

Both reports draw on Microsoft 365 unified audit data. They differ in which events they read, not in the underlying source.

The access report is the one Dave demonstrates. It is also the one that matters most for SharePoint agent governance. Knowing an agent was created tells you little. Knowing it read a finance site last Tuesday tells you a lot.

One documentation wrinkle to know about. The access report page describes its main view as sites “hosting the highest number of agents”, which is really creation-report language. Read that column as agent presence on the site. The top 20 view per site is the reliable access signal.

What the agent access insights report shows you

The report covers registered and activated agents across every SharePoint and OneDrive site in the organization. Microsoft names three categories explicitly, then adds “and more”. Those three are agents created in SharePoint, declarative agents, and custom agents.

In the browser, you get three views. First, a list of the top 100 sites. You can filter that list by site template and by governance policy. Second, the top 20 agents accessing any single site you select. Third, a distribution view split into Unique Agents found in SharePoint Sites or Unique Agents in OneDrive Account.

That third view is the heat map Dave calls his favorite part of the area. Both the browser and PowerShell cap their display at 100 sites. A downloaded report, however, can contain up to 1 million sites. Exports are therefore where large tenants should live.

The limits nobody mentions on camera

These are documented, and they shape how you schedule the work:

Report durations are fixed at 1, 7, 14, or 28 days.
Only one report can exist per duration, so you can hold a maximum of four at a time.
Generating a new report for a duration replaces the previous one. Download first if you want to keep it.
You can only run a report 24 hours after the last one generated.
On large tenants, data can take up to 48 hours to become available.
Reports draw on unified audit data, which Microsoft notes might not include every audit event.

One more catches people out. Apply a policy to a site directly from the report, and the policy status on that existing report does not refresh. Select the policy to see its latest status, or open the site’s Active site panel and check the settings there.

Turning on data collection

If your SharePoint Advanced Management entitlement comes from a Microsoft Copilot license rather than the add-on SKU, you have to switch collection on first. The cmdlets differ between the two reports, which is easy to get wrong.

For the agent access report:

Start-SPOAuditDataCollectionForActivityInsights -ReportEntity M365AgentInsights
Get-SPOAuditDataCollectionStatusForActivityInsights -ReportEntity M365AgentInsights

For the creation report, run the same cmdlets without -ReportEntity. Status comes back as NotInitiated, InProgress, or Paused, and you can generate reports once it reads InProgress.

Which agents actually show up

Microsoft’s documented list has three entries, as above. On camera I added a fourth practical category, and that grouping is mine rather than Microsoft’s published taxonomy. An agent carrying its own Microsoft Entra agent identity was provisioned through a registered blueprint. That tells you something about how it was created, though not necessarily that a developer built it, because Copilot Studio creates agent identities too.

The underlying model is worth knowing. Microsoft Entra Agent ID represents an agent identity as a service principal with servicePrincipalType set to ServiceIdentity. Three object types make up the model. Those are an agent identity blueprint, the agent identity itself, and an optional agent’s user account. That third object is currently available only to tenants in the Frontier preview program.

Agent identities hold no credentials of their own. They can also only be issued tokens in the tenant where they were created. One documented cap applies as well: non-Microsoft management platforms using app-only permissions are limited to 250 agent identities per blueprint. Delegated calls and Microsoft-owned platforms such as Foundry and Copilot Studio are exempt.

Restricted Content Discovery is the main lever, and it has edges

Spot an agent you do not recognize, and Restricted Content Discovery is what most admins reach for. Two policies apply directly from the agent access report. The other is Restricted Access Control, which limits site access to users in up to ten specified Microsoft 365 or Microsoft Entra security groups.

Here is what Restricted Content Discovery does. It limits discovery of a site’s content in organization-wide search and in Microsoft Copilot responses. It also strips the AI entry points out of the site. Users no longer see the Copilot button, the AI actions menus including agent creation, or Create pages with AI. A Restricted tag then appears on the site.

Here is what it does not do. This list is the more useful half:

It does not change permissions. Anyone with access keeps their access.
It does not remove content from the Microsoft 365 search index, so Purview eDiscovery and auto-labeling keep working.
It does not affect searches that originate from site context, nor Microsoft 365 Feed and Recommendations.
It does not work on OneDrive. Microsoft supports it for SharePoint sites only.

On camera, I asked Dave the obvious follow-up. His answer was one word:

But you block it at the site level, not the agent level. Correct?

Correct.

That holds for this lever. You restrict the site an agent is reading, which buys you time to investigate. Microsoft frames the feature the same way. The documentation describes it as a temporary governance control rather than a permanent posture. It also cautions that excessive use can reduce the content available to organization-wide search and to Copilot, which affects the completeness and relevance of results.

Timing matters too. The setting has to propagate across indexing systems. Microsoft documents that sites with more than 500,000 items can take more than a week to fully reflect the change.

Delegation is available if you want site administrators to manage it themselves. Turn it on with Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. Site administrators must then supply a justification whenever they change the setting.

Licensing and availability limits

Check this before you plan anything. The entitlement is easy to assume and easy to get wrong.

You need a qualifying base subscription first. Microsoft lists Office 365 E3, E5, or A5; Microsoft 365 E1, E3, E5, or A5; and Microsoft 365 GCC, GCC-High, or DoD. A base license alone is not enough, though. On top of it, one of three conditions must be true:

At least one user in the organization is assigned a Microsoft Copilot license. That user does not need to be an administrator.
Your subscription includes SharePoint K, P1, or P2, and you buy the SharePoint Advanced Management Plan 1 add-on.
Your organization has Microsoft 365 E7, the Frontier Suite. It bundles Microsoft 365 E5, Microsoft Copilot, Microsoft Entra Suite, and Microsoft Agent 365.

Those three routes are not equivalent. Microsoft documents some features, restricted site creation among them, as requiring the Plan 1 add-on regardless of Copilot licensing.

Microsoft 365 E5 on its own is the trap. Microsoft documents that E5 administrators can access data access governance reporting, but cannot view or use the other SharePoint Advanced Management features. Those E5 reports also come without snapshot reports and without remedial actions, and activity reports return only up to 10,000 sites.

Restricted Content Discovery carries its own requirement on top. Microsoft lists a Microsoft Copilot license as a prerequisite, because the feature is intended for Copilot deployment and governance scenarios.

For roles, you need either SharePoint Administrator or the broader SharePoint Advanced Management Administrator role. The SharePoint Admin Agent is stricter. It requires the SharePoint Advanced Management Administrator role specifically, and your organization must have SharePoint Advanced Management.

Government clouds deserve a separate look. For Copilot-licensed tenants, Microsoft documents Restricted Content Discovery and Restricted Access Control as available across commercial, GCC, GCC-High, and DoD. That same table lists a row called SharePoint agent insights, but it links to the Get AI insights button rather than to either agent report. Neither agent report has its own row, so treat their government cloud availability as undocumented rather than confirmed.

Microsoft 365 operated by 21Vianet needs care. Microsoft flags three exclusions outright, in each case even with the required licenses. Data access governance reports are unavailable there. Site access reviews are unsupported. Restricted access control reports are unavailable too. The agent insights pages carry no equivalent note. Treat 21Vianet as unconfirmed for agent reporting and check with your account team.

What is not there yet

This is the part where the recording has aged, so lead with the documentation.

Microsoft now publishes a SharePoint Admin Agent prompt that returns exactly this data. It reads: Show me a list of the top 10 agents that are accessing my SharePoint and OneDrive content. So some integration already exists. On camera Dave described that integration as still being worked towards, which was accurate when we recorded and is now partly overtaken.

The same applies to oversharing. Microsoft documents data access governance reports as a current SharePoint Admin Agent capability, not a future one. Dave presented it as coming.

His caution about file-level data still holds, and Microsoft gives a reason for it. Site access review documentation states that compliance reasons prevent administrators from accessing file-level or item-level details.

Owner and creator details remain undocumented. Dave noted the team is working on surfacing the agent owner, and it was not yet displaying during the demo. That one is his statement rather than a published commitment.

Where to go next

Ready to see which agents are already reading your content? Open the SharePoint admin center, expand Reports, select Agent insights, then select Agent access. If you have never generated one, start with a 28-day report so you have a full window to look at. Remember you cannot regenerate it for another 24 hours.

Good SharePoint agent governance starts with knowing what is out there. For the wider picture of what shipped this year, read my breakdown of what’s new in SharePoint Advanced Management for 2026. If you need to find agents across the whole tenant rather than just SharePoint, my write-up on Microsoft’s unified agent inventory covers the Microsoft 365 admin center side. And if your reports come back as an undifferentiated wall of sites, SharePoint catalog management is the piece that gives them structure.

SharePoint Oversharing Reports and the New SAM Admin Role

Vlad Catrinescu — Tue, 01 Sep 2026 00:04:11 GMT

SharePoint oversharing reports used to stop at the site. Now they reach the individual file. Running one also takes a brand new admin role, and not even a global administrator holds it by default. Here is what changed, what the export contains, and who should be allowed to open it.

Key takeaways

One feature covers two runnable reports, one for content shared with Everyone and one for content shared with Everyone except external users.
Both require the SharePoint Advanced Management Administrator role. A global admin must assign it explicitly, even to themselves.
Microsoft tells you to generate the site permissions report at least once first. Treat that as a prerequisite.
Each download is a ZIP containing a CSV, capped at 1 million rows. You can only rerun a report every 30 days.
The export includes a TotalUserCount column that separates who can reach a file from who actually has.
Microsoft 365 E5 without SharePoint Advanced Management does not get snapshot reports, so this report is out of reach on E5 alone.

The Five Types of SharePoint Oversharing

Oversharing sounds like one problem. In practice, it arrives in a handful of recognizable shapes.

Dave Minasyan is the Principal Product Manager for SharePoint Advanced Management at Microsoft. He groups those shapes into five basic types. By his estimate, those five cover roughly 80 to 90 percent of the oversharing patterns his team sees across tenants. Both the grouping and the figure come from the product team rather than from published documentation. Treat them as field observations, not measured statistics.

Microsoft Learn publishes no numbered “five types” list. What the documentation does give you is six risk signals worth watching for:

Broad sharing through “Anyone,” “Everyone,” and organization-wide links
Large audiences with excessive permissions
Broken permission inheritance and complex access models
Sensitive content with weak protection
Unlabeled or public sites
Governance gaps with ownerless, inactive, or unreviewed sites

The content management assessment uses a tighter grouping. It flags oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and sites that are inactive or ownerless. That maps almost exactly onto Dave’s five.

Microsoft also notes that risk compounds. Sites where several signals overlap deserve your attention first. A public site with no owner is a problem. A public site with no owner, sensitive data, and an “Anyone” link is an emergency.

Start With the Permission State Report

The permission state report remains the flagship tool, and everything else depends on it. Microsoft documents it as the site permissions for your organization report. It gives you a snapshot of your permission structure across every SharePoint and OneDrive site.

The report counts total permissioned users, Microsoft Entra groups, and broken inheritance. It also counts EEEU permissions, Everyone permissions, guest user permissions, external participant permissions, and sharing links. Microsoft generates separate reports for SharePoint and for OneDrive.

Several documented details rarely come up in conference sessions. Each one affects how you plan:

The first report takes up to 5 days, regardless of tenant size. Later runs finish within 24 hours.
Reports capture data from up to 48 hours before generation, so the numbers are never live.
You can run reports again every 30 days.
The interface shows the top 100 sites by user count. The CSV download covers up to 1 million sites.
Sites with a NoAccess lock status are excluded, and so are archived sites.

The most useful idea in the documentation is the split between current and potential exposure. Adding users directly, or through a Microsoft Entra group, raises the permissioned user count immediately. Creating a sharing link does not, and neither does granting access to Everyone except external users. Those actions create potential exposure. It only becomes real when someone opens the content.

One more caveat matters if you audit classic sites. The EEEU and Everyone counts deliberately exclude hidden system files and system groups, because those permissions exist by design.

Where Microsoft Purview Fits In

Dave confirmed that his team is working with the Microsoft Purview team on a specific integration. The goal is to bring sensitive file type information directly into the permission state report. Once configured in Purview, that data would flow into the report and help you decide which sites deserve attention first.

That integration appears nowhere in the documentation, so treat it as roadmap rather than something usable today. Microsoft Purview does show up in the official guidance, but as a parallel tool you cross-reference by hand, not as a feed into this report.

What you can use today is the Site Sensitivity column already in the CSV. It carries the sensitivity label applied to the site itself, not to individual files. For file-level label data, Microsoft ships a separate sensitivity labels for files report. The SharePoint Advanced Management overview page calls the same thing the sensitivity label snapshot report, so expect both names.

SharePoint Oversharing Reports Now Reach the File Level

Site-level numbers tell you where to look. They do not tell you what to fix. Admins have asked Microsoft for file-level detail for years, and it has now shipped.

The feature is called Sites and files shared via special SharePoint groups. You will find it in the SharePoint admin center under Reports, then Data access governance, in the Snapshot reports area. It is one feature with two runnable reports, because each special group gets its own. Dave announced the “Everyone except external users” version on camera, and Microsoft shipped a matching report for the Everyone group alongside it.

Each row identifies a single item one of those groups can reach. You also get the full chain of identifiers, running from your tenant down to that item. Each row carries the permission level granted, plus the parent group when access is indirect.

There is no browsable data grid, and that is intentional. The admin center gives you a status tile showing that the report is available, the date it was generated, and the number of sites found. Everything past that lives in the download. As Dave explained it, these reports can be very massive, so Microsoft skipped the interface and went straight to the export. The documentation frames the same decision around outcomes. Use these SharePoint oversharing reports when you want to fix problems through scripting, rather than asking site owners to review permissions one site at a time.

What You Actually Get in the Export

The download is a ZIP file containing a CSV, and it is capped at 1 million rows. On camera, Dave estimated that a permission report “can have like a million rows.” That turns out to be the documented ceiling rather than an exaggeration.

The CSV carries 20 columns. Most are identifiers that form a hierarchy from your organization down to a single item. As a result, you can pivot or summarize at any level. Filter on one site ID and you see every permission inside that site, across every scope.

A few columns deserve specific attention:

ItemType tells you what the row describes: Web, List, Folder, or File. List items count as files.
Role definition gives the permission level, such as Full control, Read, Edit, Contributor, Creator, or Viewer.
ParentGroupType and ParentGroupName appear when access is indirect. Together they show whether the path runs through a security group, a SharePoint group, or a Microsoft 365 group.
TotalUserCount is the column most people will miss. It counts users who have actually opened the item at least once.

That last column turns an intimidating list into a prioritized one. The item is already shared with everyone internally, so this number is your real exposure rather than your theoretical exposure. Ten thousand overshared files nobody has ever clicked is one problem. Fifty overshared files that hundreds of people have opened is a very different one.

Four constraints are worth knowing before your first run. Microsoft tells you to generate the site permissions report at least once beforehand, though the documentation never spells out what happens if you skip that step. Data can be up to 48 hours old. You can only rerun it every 30 days. Finally, the report always covers both SharePoint and OneDrive, and you cannot scope it to one workload.

Licensing is the constraint that stops most people, and it is easy to miss. Microsoft states that E5 administrators can reach data access governance reporting without SharePoint Advanced Management. Those reports, however, do not include snapshot reports or remedial actions. This is a snapshot report, so E5 alone will not get you there. The reports are also unavailable for Microsoft 365 operated by 21Vianet, even with the right licenses.

The report also excludes system files and system groups. Microsoft gives a concrete example: the Everyone group inside the Style Resource Readers group on classic publishing sites. That membership is intentional, since it controls access to the master page gallery and the style library. Remove it, and users start seeing broken pages.

The New SharePoint Advanced Management Administrator Role

File-level visibility arrived with a new security model attached. The SharePoint Advanced Management Administrator role is a built-in Microsoft Entra role. Microsoft documents it as a superset of SharePoint Administrator.

Assign it, and the holder can do everything a SharePoint Administrator does, plus three things a SharePoint Administrator cannot:

View names, paths, and URLs of files, folders, libraries, documents, and lists inside SharePoint sites
Remove permissions from those same objects
Manage SharePoint Advanced Management features

One boundary deserves more attention than it usually gets. The role grants visibility into file names, paths, and URLs without granting access to file or item content. An admin can see that a file called “2027 Layoff Plan.docx” is shared company-wide, and they can strip that permission. The role alone does not let them read it.

Because the role is a superset, you do not need both. If you are the only SharePoint admin at your company, take this role and drop the other one. In a larger team, treat the split as a deliberate decision about who sees file names.

Why Global Admins Have to Opt In

Here is the part that surprises people, and I confirmed it in my own demo tenant before publishing. A global administrator cannot run the file-level report. Microsoft documents the same behavior plainly. Standard SharePoint administrators and global administrators cannot view file properties across sites they do not own. A global administrator must assign the SharePoint Advanced Admin role before the report will run.

You can, of course, grant the role to yourself, since you are the global admin. The point is that you make that choice consciously, and the choice is auditable.

I described this to Dave as the Microsoft Purview model, where even a global admin starts with nothing by default. He pushed back on the framing. In his view, it is not a Purview pattern at all. It is a general data compliance requirement, and it applies the moment any tool starts touching files rather than sites. His reasoning was blunt. Whoever holds this role could potentially see file names inside a chief executive’s own content, and that is not access you hand out by default.

Having spent over a decade in SharePoint environments, I would argue the distinction is academic for most admins. Purview works this way precisely because compliance demands it. Dave is right on the technicality, though. That technicality is exactly why this role exists as a separate assignment rather than a checkbox.

What This Means for You

Start by running the site permissions report, because nothing else works until you do. It is a hard prerequisite for the file-level reports. On a first run, it can take up to 5 days, so kick it off before you need the data.

Next, decide who holds the SharePoint Advanced Management Administrator role. Decide it before someone urgently needs a report. If you are a one-admin shop, this is simple. Take the role, since it includes everything your current role does. If you have a team, have the conversation about file-name visibility while it is still hypothetical.

Then plan your cadence around the 30-day rerun limit. A quarterly rhythm works well for the snapshot reports. Pull the file-level export ahead of any significant Copilot or agent rollout. Remember that the data is already up to 48 hours old when it lands. These SharePoint oversharing reports are a planning instrument, not a monitoring one.

Finally, sort out your analysis path before the CSV arrives. A million-row file is not something you skim. Excel with Copilot, Power BI, or a short script will all work. Dave was direct about why Microsoft chose the CSV format: admins who need file-level data already know how to handle large exports. File-level data is not in the SharePoint Admin Agent yet, though Dave said bringing it in is on the roadmap.

Ready to find out where your own oversharing lives? Open the SharePoint admin center, go to Reports, then Data access governance. Check whether your site permissions report has ever been generated. That one answer tells you whether the file-level reports are available today or five days from now. For the wider picture of what shipped this year, read my breakdown of what’s new in SharePoint Advanced Management for 2026. To scope reports to a department instead of your whole tenant, start with SharePoint catalog management. And if your next step is keeping sensitive sites out of Copilot, see my first look at Restricted Content Discoverability.

Dave reads the comments on these interviews personally. If you have a feature request for SharePoint Advanced Management, that is the place to leave it. You can also connect with Dave Minasyan on LinkedIn. For more Microsoft 365 governance coverage, subscribe to the Vlad Talks Tech newsletter at vladtalkstech.com.

Microsoft 365 | Vlad Talks Tech

Copilot in SharePoint FAQ: Your Agents, Skills and Autofill Questions Answered

Getting Copilot in SharePoint in your tenant

How do I know when Copilot in SharePoint is available in my tenant?

Does Copilot in SharePoint work in GCC?

What is Site AI?

What the Copilot license covers, and when you need Copilot Credits

Does creating a skill cost extra?

Will the prebuilt SharePoint page and list agents need Copilot Credits?

Can everyone use an agent I put on a site?

Does testing an agent in the preview pane use credits?

SharePoint agents are moving to Agent Builder

Is a SharePoint agent basically an Agent Builder agent now?

Why did the agent in my navigation disappear?

Does a SharePoint agent get a Microsoft Entra ID, and does it show up in Agent 365?

Can an agent answer only from approved documents?

Can I choose the model Copilot in SharePoint uses?

Autofill columns

Do autofill columns work with site columns and the term store?

Does turning on autofill add the column to every library on the site?

Can I roll out autofill columns across hundreds of libraries?

Protecting your content

Can I use SharePoint Advanced Management to keep sites out of Copilot?

Can admins sanitize the HTML that Copilot creates?

What this means for you

Microsoft 365 Archive FAQ: Copilot, Retention, Reactivation and Cost

How Microsoft 365 Archive works

What is Microsoft 365 Archive?

Does archived content leave SharePoint?

Does archived content stay in the same country?

Copilot and search

Does Copilot use archived content?

Can users still find archived files in search?

What changes when content is archived

Does archiving change a site’s storage quota?

How long does reactivation take?

Do eDiscovery, legal holds and retention policies still work?

Archiving is not retention

Does archiving a file mean it’s retained?

Will a retention policy that deletes content also delete archived files?

File-level or site-level archive

When should I use file-level archive instead of site-level archive?

Can I archive a Teams site with private or shared channels?

What archiving looks like for your users

How does a user archive a file?

What can users do with an archived file?

Can you archive or reactivate a file on a locked or read-only site?

Why you can’t archive a folder

Where admins can see how much is archived

Start manually, then scale with policies

Which policies can archive files automatically?

Do the policies need extra licenses?

What Microsoft 365 Archive costs

What about OneDrive accounts of people who left?

Should I turn on SharePoint pay-as-you-go storage too?

What this means for you

Identity Secure Score in Microsoft Entra ID: What to Fix First

What Identity Secure Score measures

How the score updates, and where else it shows up

Which recommendations have the biggest impact?

Require multifactor authentication for administrative roles

Protect all users with a sign-in risk policy

Protect all users with a user risk policy

Enable policy to block legacy authentication

Identity Secure Score on the AB-900 exam

Checking the score in a real tenant

Why your score can go down

What this means for you

AB-650 Exam Review: Where Your Study Hours Should Really Go

What the AB-650 exam really tests

What I would brush up on

Microsoft Entra ID

Microsoft Defender for Office 365

Microsoft Purview

Copilot and Agent 365 in the Microsoft 365 admin center

SharePoint Advanced Management

Learn where things live across the admin centers

How much PowerShell is on the AB-650?

Where to start if this is your first Microsoft exam

What to expect on exam day