Vlad Talks Tech

SharePoint Skills FAQ: Your Webinar Questions Answered

Vlad Catrinescu — Fri, 25 Sep 2026 04:07:27 GMT

The Teams gremlins held my camera hostage for part of my Getting Started with SharePoint Skills webinar, but the questions kept coming, and I ran out of time before I ran out of questions. This SharePoint skills FAQ answers every question from the Q&A panel and the chat, including the ones I answered live, double-checked against Microsoft Learn and Microsoft’s latest updates. If you missed the live session, you can watch the full SharePoint skills webinar recording on my YouTube channel.

Key takeaways

A skill is not a saved prompt. It’s a shared, multi-step workflow that everyone on the site can trigger in plain English, and Copilot in SharePoint doesn’t have saved prompts anyway.
Skills run when someone asks for them in the Copilot in SharePoint chat. They can’t run on a schedule, on a file event, or from Power Automate today.
Personal skills live in your OneDrive and are for you only. To share a skill with your team, create it as a site skill on the team’s SharePoint site.
You protect skill files like any other SharePoint content: break inheritance on the Agent Assets library, and people with View access can still run the skills.
There’s no official application lifecycle management (ALM) for skills yet, so keep a copy of business-critical skills in a central repository and use PnP PowerShell or Microsoft Graph PowerShell for inventory.
A SharePoint agent answers questions about content. Copilot in SharePoint with skills takes action on that content.
Microsoft just announced that Copilot in SharePoint has hit General Availability and also clarified the billing model!

Skills vs Saved Prompts and Other Tools

Why Is a Skill Different From a Saved Prompt?

Microsoft 365 Copilot does let you save prompts in the Copilot Prompt Gallery from Copilot Chat, Teams, and Outlook, but Copilot in SharePoint doesn’t have saved prompts, so on a SharePoint site a skill is the way to package a request people can reuse. There is some overlap in the idea, since both save you from retyping the same instructions. The difference is everything a skill adds on top.

A skill lives on the site, so everyone with View access can run it. Nobody has to find the prompt in a Notepad file or a OneNote page. People just ask in natural language, and Copilot in SharePoint matches the request to the skill through its description. A skill can also chain several steps, load reference files, and call other skills, so it handles long-running tasks a single prompt can’t.

The biggest difference is consistency. A saved prompt behaves differently depending on who runs it, because each person’s memories and customizations shape the answer. A skill documents the process once, so everyone gets the same steps and the same output. Microsoft’s skills documentation says skills let Copilot in SharePoint perform tasks “more consistently than one-off prompts.”

When Should I Use a Skill Instead of a Power Automate Flow, a Copilot Studio Agent, or a SharePoint Agent?

Use a skill when the work stays inside SharePoint and benefits from judgment: reading documents, classifying them, checking them against a rule, and updating lists or libraries based on what it finds. Skills are no-code, multi-step, and use AI to understand intent, but today they can’t connect to external systems or run custom code. That first limit is about to loosen: Copilot in SharePoint is getting support for plugins from your enterprise store, and a plugin can bundle skills and Model Context Protocol (MCP) servers that connect to other systems. It’s in preview and scheduled to roll out worldwide in December 2026, according to the Microsoft 365 roadmap.

The other three options each fit a different job:

A Power Automate flow is deterministic. It follows the exact same path every time, connects to third-party systems through connectors, and handles formal processes like approvals through Outlook. When the process must never vary, or it has to reach outside Microsoft 365, use a flow.
A SharePoint agent answers questions. It’s grounded in your SharePoint content, but it doesn’t take action on that content.
A Copilot Studio agent is for scenarios beyond SharePoint. Custom engine agents built in Copilot Studio can reach other systems and even trigger actions automatically, without a user asking. They’re also more work to build, deploy, and maintain.

This is exactly the question my October 20 webinar goes deeper on, with scenarios for each option. The registration link is at the end of this post.

Running Skills

Can Skills Run on a Schedule, When a File Is Added, or From Power Automate?

Not today. A skill runs when someone asks for it in the Copilot in SharePoint chat, either with a matching request or by naming the skill. You can’t trigger a skill from a file event, run it on a schedule, or call it from a Power Automate flow.

If what you need is a simple reaction to a file event, SharePoint’s built-in workflows for lists and libraries now cover some of it. In its September 2026 update, Microsoft added workflows that post a Teams message when files are added or metadata changes, and workflows that route approval requests. Those are separate from skills, but they might cover the event-driven part of your scenario.

Is There a Limit to How Many Documents a Skill Can Classify, and Can It Handle 10,000 Files?

I haven’t found a published limit on how many files a skill can process, and I haven’t tested a 10,000-file library myself. I’m checking with the product team and will update this post when I hear back.

What is documented is the usage limit. During the preview, according to the Copilot in SharePoint get-started guide, Copilot in SharePoint applies daily and weekly usage limits to each user. The limits are individual, not shared across your organization, and when you hit one, Copilot features pause until the limit resets automatically. A classification run across thousands of files does a lot of work, so plan for it:

Test the skill on a few selected files first, then on a single folder.
Run large libraries in batches, folder by folder, instead of in one request.
For files that keep arriving, look at autofill columns in SharePoint, which extract metadata as files are uploaded, so you only run the skill once on the backlog.

In the blog post from September 25th, Microsoft has announced the ability to work with Copilot in SharePoint to operate across large content collections, but I do not know yet what large means!

Can a Skill Create Site Pages From a Template and Add Quick Links Web Parts?

Creating pages, yes. Copilot in SharePoint can create pages, and a skill chains Copilot in SharePoint’s built-in capabilities, so page creation can be one of the steps. Whether it can also add and configure a Quick Links web part that points to related pages depends on the page tools available in your tenant.

The quickest way to check is to type --agenttools in the Copilot in SharePoint chat, which lists every action Copilot in SharePoint can run on that site, and look through the page-related tools. The list of tools differs from tenant to tenant, so check yours rather than relying on someone else’s screenshot. Then test the skill on one page before running it across a site.

A skill you create in OneDrive is a personal skill, and personal skills are designed to be yours alone. That’s why you got the message that the skill doesn’t support sharing with everyone who can access the folder. So yes, it comes down to OneDrive instead of SharePoint, though the real distinction is personal versus site scope.

Personal skills are saved as Markdown files in your own OneDrive, under Documents, Copilot, Agent Assets, Skills, and they follow you across every SharePoint site and OneDrive. They’re perfect for your own way of working, like how you want long documents summarized. They rolled out in preview in August 2026 and roll out worldwide in December 2026. Microsoft announced them in its September update, but the Microsoft Learn skills article only covers site skills so far.

To share a skill with your teammates, create it as a site skill instead. Open the Copilot in SharePoint chat on your team’s SharePoint site and create the skill there. It’s saved to that site’s Agent Assets library, and everyone with View access to the site can run it.

How Do I Protect the Skill Files in the Agent Assets Library?

You protect them the same way you protect any other SharePoint content. By default, anyone with Edit permission on the site can create a skill, and anyone with View permission can run one, which means every member of a team site can change the skill files. If you want a tighter model, Microsoft’s documentation points you to breaking permission inheritance on the Agent Assets library and applying more restrictive permissions.

In practice, that means giving members Read on the Agent Assets library and keeping Edit for the owners and the few people who author skills. Members can still run every skill, because running a skill only needs View access. Retention, sensitivity labels, and auditing apply to skill files too, and the library keeps version history, so you can roll a skill back if someone breaks it.

You already spotted the trade-off: once members can’t edit the library, they can’t create skills on that site anymore. The same library holds your SHAREPOINT.md file, so locking it down protects your site context too. The library also holds a Plans folder, so after you change the permissions, sign in as a member and run a skill to confirm everything still works the way you expect.

Governance and Lifecycle Management

Can I Maintain SKILL.md Files With Azure Pipelines in Azure DevOps?

Not officially, and I’ll be honest, this is one of the more disappointing parts of the preview. Skills are managed at the site level, and Microsoft doesn’t offer a supported way to deploy or update them from a pipeline.

In the meantime, a few things help:

Version history. Skills are files in a document library, so every change is versioned and you can restore an earlier version.
Built-in skills that improve your skills. Microsoft ships built-in skills to create, check, and improve skills. In September 2026 they added measured evaluations, where Copilot suggests tests, evaluates the current results, and recommends changes before you share a skill more broadly.
A preview of what’s coming. When you type /skills, the list includes a section for enterprise skills. It was empty in my tenant during the webinar, but it shows where Microsoft is heading for centrally managed skills.
Plugins from your enterprise store. A plugin can bundle skills, and an admin can install it tenant-wide, so once plugin support rolls out you’ll have a governed way to distribute the same skills across sites.

Until then, my recommendation is simple: when a skill becomes business-critical, keep a copy in a central repository you control. That gives you a source of truth even without an official process.

Until Enterprise Skills Arrive, Is PnP PowerShell the Way to Govern Skills?

Yes. Since skills are Markdown files stored in each site’s Agent Assets library, PnP PowerShell works well for building an inventory: loop through your sites, look in the Skills folder of the Agent Assets library, and each subfolder with a SKILL.md file is one skill. Microsoft Graph PowerShell works too. Auditing also applies to skill files, the same as other SharePoint content.

I can’t wait for Microsoft to give us proper governance for skills. Governance for SharePoint skills and agents would make a great future webinar topic too.

SharePoint Agents vs Microsoft 365 Copilot Agents

Every SharePoint site comes with a ready-made agent that answers questions based on that site’s content. People with Edit permission can also create custom agents, which are saved as .agent files in the site’s Site Assets library, scoped to the sites, folders, or files you choose, and tailored with your own instructions.

Custom agents don’t automatically appear in any list, so you share them like any other file. People can open the .agent file, and you can also share a SharePoint agent in Teams group chats and meetings. Site owners also decide what opens when people select the agent icon, either Copilot in SharePoint or a custom agent, and access always follows the site’s permissions.

Keep in mind that SharePoint agents answer questions, while Copilot in SharePoint is the experience that runs skills and takes action. My step-by-step guide to creating SharePoint agents walks through building one.

Is a SharePoint Agent the Same as an Agent Created in Microsoft 365 Copilot?

No. A SharePoint agent lives in its SharePoint site and only uses SharePoint content. An agent you build with Agent Builder in Microsoft 365 Copilot can use knowledge from SharePoint, Teams, Outlook, public websites, and Microsoft 365 Copilot connectors, and you can share it across the organization or submit it to your organization’s catalog.

Where you build it depends on where the content lives and what the agent needs to do:

Build it in SharePoint when the content lives on one site and the audience is that site’s members.
Build it with Agent Builder when the agent needs content from several places, like Teams and Outlook as well as SharePoint. My guide to building Copilot agents with no code in Agent Builder covers the basics.
Build it in Copilot Studio when the agent needs to take actions in other systems or run without a user asking.

Agent Builder agents can do a lot more, but they’re also a bit more work to maintain and deploy.

What This Means for You

Most of these questions come down to the same thing: skills are still a preview feature, and the parts around them, like scheduling, lifecycle management, and governance, haven’t caught up yet. That doesn’t make them less useful today. It means you should be deliberate about where you use them.

If you’re an admin, decide who can edit the Agent Assets library on your important sites before skills spread, and start keeping business-critical skills in a central repository now. If you’re a builder, pick one repetitive task that stays inside SharePoint, build it as a site skill so your whole team can use it, and test it on a small set of files before pointing it at a large library.

Ready to take SharePoint skills further? On October 20, Microsoft MVP Gokan Ozcifci and I are running a free webinar on automating content in SharePoint with Copilot, covering more advanced skills, SharePoint agents, and autofill, and when to reach for each one. Save your seat for the October 20 webinar.

SharePoint Advanced Management Roadmap: Shipped and Coming

Vlad Catrinescu — Tue, 01 Sep 2026 00:28:24 GMT

SharePoint Advanced Management (SAM) has grown into a full content governance suite for Microsoft 365, with its own AI assistant on top. This post tracks the SharePoint Advanced Management roadmap against Microsoft’s own documentation. You will see what has actually shipped, what Microsoft has said is still coming, and what each part means for you.

This roadmap check is accurate as of August 2026. Roadmap items move quickly, so status and dates can change after this date. Where something is documented, I link to Microsoft Learn. Where it is not, I attribute it to the product team and date it.

Key takeaways

The SharePoint Admin Agent is live. It answers governance questions in plain language and needs the new SharePoint Advanced Management Administrator role.
Catalog management, the content management assessment, and item-level oversharing reports have all shipped and are documented on Microsoft Learn.
Two things Microsoft framed as “coming” have since shipped: Microsoft Agent 365 (generally available since May 1, 2026) and the mid-2026 feature wave.
Some pieces are still on the way, including a site owner governance experience (name not final), catalog-scoped policies, and sensitive info type data in the permission report.
Licensing matters. SAM needs a Microsoft 365 Copilot license, the SAM add-on, or Microsoft 365 E7. Microsoft 365 E5 on its own gives you reporting only.

What SharePoint Advanced Management can do today

Most of the roadmap is already real. Here is what is documented and available right now.

The SharePoint Admin Agent

The headline feature has shipped. The SharePoint Admin Agent is an AI-powered governance assistant that reasons over your SharePoint and SAM data. You ask a question in plain language, and it returns analysis and guided remediation. You can open it in the Microsoft Copilot app, in the SharePoint admin center, or in Microsoft Teams.

Where to start: the content management assessment

Not sure where to begin? Run the content management assessment. Open Advanced Management in the SharePoint admin center navigation pane and select Start assessment. SAM then runs a suite of reports and flags the sites that need attention.

The assessment covers five areas: inactive sites, site ownership, broken inheritance, sharing with Everyone except external users, and overly permissive sharing links. Microsoft recommends rerunning it every 30 days.

One caveat on timing, because two different reports quote different windows. The assessment page lists a run time of 2 to 72 hours, depending on tenant size. The separate site permissions snapshot report is slower. Microsoft says its first run can take up to 5 days, regardless of tenant size. Either way, start early and do not expect instant results.

Catalog management: structure your sites

Catalog management has shipped, including the custom options. It groups your sites into categories and groups. That structure then lets the SharePoint Admin Agent give more targeted insights instead of reasoning over everything at once.

Out of the box, catalog management builds categories from Microsoft Entra ID and SharePoint metadata, such as department and locale. These refresh every hour. You can also build your own categories three ways:

CSV upload: create curated categories with up to 20 groups each.
Custom site property: point SAM at a site property, such as a cost center, and it creates one group per value. This option covers up to 20,000 sites.
Microsoft Entra ID extension attributes: group sites by the values in extension attributes 1 through 15.

One gap is worth noting. Catalog management groups SharePoint sites, and the documentation does not mention SharePoint Embedded containers.

Oversharing reports and the new admin role

The permission state report is still the flagship oversharing tool. The bigger news is file-level reporting. A new report, Sites and files shared via special SharePoint groups, has shipped. It lists the items shared with Everyone except external users (EEEU) or Everyone. It is a downloadable export of up to 1 million rows, not a dashboard.

File-level data comes with a stricter security model. The SharePoint Advanced Management Administrator role is required to run these reports. It is a superset of the SharePoint Administrator role. Even a Global Administrator cannot view file properties across sites they do not own without it.

Two more oversharing tools are live. Site access reviews let you ask site owners to fix overshared sites, up to 100 sites per request, and up to 1,000 reviews a month from the organization-wide permissions report. Restricted Content Discovery removes AI entry points, such as the Copilot button and agent creation, from a site. You can also delegate it to site administrators.

Agent access insights

Agents now leave a trail across your content, and you can see what they touch. The agent access insights report lists the agents reaching your SharePoint and OneDrive content. You find it in the SharePoint admin center under Reports, then Agent insights, for the past 1, 7, 14, or 28 days.

The report covers SharePoint agents, declarative agents, and custom agents. From the report, you can act right away by applying Restricted access control or Restricted Content Discovery to a site.

Resilience: settings and backup

Resilience is the newest pillar, and the agent surfaces most of it. Ask the agent whether Baseline Security Mode is enabled, and it returns a status. Ask about recovery options, and it reasons over your Microsoft 365 Backup state.

Multi-Geo, in preview

Multi-Geo has a start, but it is still preview. On Microsoft Learn, the agent’s cross-geography content move prompts are marked as preview. They let you check the status of cross-geo moves and find libraries that need to move.

What’s still coming on the SharePoint Advanced Management roadmap

The rest of the list is not documented yet. These points come from Dave Minasyan, the Principal Product Manager who leads SAM at Microsoft, in our 2026 conversation. I am reporting them as his statements at the time of recording, not as shipped features. As someone who has presented on SAM at conferences for years, I would treat this section as direction, not dates.

A storage card in the assessment. Dave said storage analysis is coming to the content management assessment. Today the assessment documents five reports, and storage is not one of them.
SharePoint Embedded containers in catalog management. Dave said onboarding containers to SAM is in progress. It is not documented yet.
Catalog-scoped policies. Dave described scoping lifecycle policies to a catalog category. The policy documentation still lists other scopes only.
Batched emails and a site owner governance hub. Dave described batched emails, one for lifecycle and one for oversharing, plus a single hub page for site owners. He added that the governance hub name is not final. Microsoft documents per-report tailored emails today, not the batched model or the hub.
Sensitive info type in the permission report. Dave said Microsoft is working with Purview to bring sensitive file type data into the permission state report. Note one nuance: the site-level sensitivity label already appears in the report. The file-level sensitive info type integration is the part still coming.
Deeper agent insights. A heat map view and richer agent owner details are still developing.
Cross-workload governance. Dave said Microsoft wants to bring content governance context to Teams and Exchange admins. It is not documented yet.
A growing agent skill set. Dave said the agent’s skills will keep expanding. The specific counts he shared are not documented, so I am leaving numbers out.

Two things that shipped since this was recorded

Roadmap content dates fast, and this conversation is a good example. Two things Dave described as coming have since shipped.

First, Microsoft Agent 365. At the time of recording, Dave described it as “going to be coming in.” Microsoft Learn now states that Microsoft Agent 365 is generally available as of May 1, 2026. It is a separate product from the SharePoint Admin Agent, and it acts as a control plane to observe, govern, and secure agents.

Second, the mid-2026 wave. Dave pointed to a June, July, and August release window. That window has effectively closed, and the named items landed inside it. Catalog custom groups and the item-level oversharing report are both documented and live today.

Licensing and availability: what you actually need

The roadmap conversation skips licensing, so here are the details from Microsoft Learn.

You need a qualifying base subscription first. That means Office 365 E3, E5, or A5, or Microsoft 365 E1, E3, E5, or A5, or a government plan.

Then you unlock SAM one of three ways, per the prerequisites:

at least one Microsoft 365 Copilot license assigned in the tenant,
the SharePoint Advanced Management Plan 1 add-on (on a SharePoint K, P1, or P2 plan), or
Microsoft 365 E7, also called the Frontier Suite.

Microsoft 365 E5 on its own is not enough for the full suite. Microsoft documents this clearly. An E5 admin without Copilot gets data access governance reporting only. There are no snapshot reports, no remedial actions, and activity reports return up to 10,000 sites.

Sovereign clouds are supported, with gaps. Microsoft 365 operated by 21Vianet does not support data access governance reports or site access reviews, even with the required licenses.

Finally, plan for the role. The SharePoint Advanced Management Administrator role is a superset of the SharePoint Administrator role, and it gates file-level reporting. Even Global Administrators must assign the role before file-level reports will run.

What this means for you

Start with the free wins. Run the content management assessment if you have SAM. It is one click, and the results guide everything else. Because it can take up to 72 hours, start it early and put a monthly rerun on your calendar.

Next, plan your structure. Sketch catalog categories that match how your organization works, and clean up your Microsoft Entra ID department attributes so sites do not pile into an “other” bucket. Good structure makes every report and policy more precise.

Then sort out access and licensing. Decide who gets the SharePoint Advanced Management Administrator role, since file-level reports will not run without it. Confirm which license path unlocks SAM for you, and check the E5 and 21Vianet limits if either applies.

One last habit for roadmap content: treat status as a moving target. Two items in this very conversation shipped before this post went live. Re-check Microsoft Learn before you promise a feature to your organization.

Want the full walkthrough of each feature? I broke down every part of the 2026 wave in my guide to what’s new in SharePoint Advanced Management. I also covered the licensing model in my SharePoint Advanced Management licensing Q&A with Microsoft. For the agent governance side, see my recap of Agent 365 from the ESPC keynote. To keep up as the roadmap ships, subscribe to the Vlad Talks Tech newsletter at vladtalkstech.com.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

SharePoint Content Resilience: Backup, Archive & Multi-Geo

Vlad Catrinescu — Tue, 01 Sep 2026 00:06:16 GMT

SharePoint content resilience comes down to one question: when something goes wrong with your content, can you get it back? Microsoft answers with a small stack of features. Now it is wiring them into the SharePoint Admin Agent, so you can reason over them in plain language.

In Part 8 of my SharePoint Advanced Management 2026 series, Microsoft’s Dave Minasyan walked through where this is heading. Dave is a Principal Product Manager at Microsoft. This post is the standalone version. As a Microsoft MVP who works in these tenants every day, I will keep it practical. You will learn what each piece does, what it costs, and where the limits are.

Key takeaways

Microsoft defines content resilience as Baseline Security Mode, Microsoft 365 Backup, and version history. Archive and Multi-Geo sit next to it under lifecycle and data residency.
The SharePoint Admin Agent can now check Baseline Security Mode and surface recovery options in plain language. The Multi-Geo prompts are still in preview.
Backup and Archive are pay-as-you-go and need an Azure subscription. Multi-Geo is a separate paid add-on with a five percent minimum.

What SharePoint Content Resilience Means

Content resilience is the protection side of content governance. In other words, it is how you keep content safe, recoverable, and in the right place. Microsoft Learn is specific about the term. On the SharePoint Admin Agent page, content resilience means three things: Baseline Security Mode, Microsoft 365 Backup, and version history.

Two other features come up in the same conversation. Microsoft 365 Archive is technically part of content lifecycle, not resilience. Multi-Geo is filed under data residency compliance. I cover all of them here because they answer the same real question. How do you protect and control your content? Still, it helps to know how Microsoft groups each one. Each is also licensed very differently.

The SharePoint Admin Agent’s New Resilience Skills

Most of these capabilities already exist in the admin experience. What is new is that the SharePoint Admin Agent can now reason over them. As Dave put it, the team is hooking the resilience areas into the agent. Now you can ask questions instead of hunting through pages.

Microsoft Learn backs this up. The SharePoint Admin Agent page lists content resilience as a supported capability. It also publishes ready-to-try prompts. Two of them are generally available today. The first is “Is Baseline Security Mode enabled in my tenant?” The second is “What recovery options are available for my SharePoint and OneDrive sites?” On camera, Dave described the backup piece as something the team was “building out right now.” By the time of writing, that recovery prompt is already live. So treat it as here, not coming.

The agent also honors your role. On camera, Dave showed that a SharePoint admin sees only the SharePoint state in the agent, not vulnerabilities in another workload like Microsoft Entra ID. That is the agent scoping the view to your role. The Baseline Security Mode page works in a related way. The settings area is visible to several workload admins, but each one can manage only their own settings. Dave also shared some numbers on camera, though he hedged them. He estimated the skill covers around 45 tenant settings today. The team has identified roughly 250 so far, with about 60 data points behind the analysis. Those figures are his estimate, not a documented count, so use them directionally.

Baseline Security Mode, Checked for You

Baseline Security Mode is a set of security settings you turn on in the Microsoft 365 admin center. You find it under Org Settings, in the Security and Privacy tab. That admin center home is why Dave calls this the organizational settings area. It brings settings that used to live only in PowerShell into a single page.

Here is a detail worth knowing. Baseline Security Mode works on all Microsoft 365 subscriptions and plans, so there is no extra license gate. Access is role-based instead. A SharePoint admin manages the SharePoint and OneDrive settings. Other workloads stay with their own admins.

Microsoft recommends a phased approach, and it matches the agent’s report card. First, you run an impact report for each setting. Next, if the report shows zero impact, you turn the setting on. Finally, if critical dependencies exist, you fix those before you commit. The agent is essentially putting a conversation in front of that same workflow.

Microsoft 365 Backup: Point-in-Time Restore

Microsoft 365 Backup gives you fast, point-in-time restore for SharePoint sites, OneDrive accounts, and Exchange mailboxes. It is built inside the Microsoft 365 trust boundary, so your data never leaves it. Backups are append-only. That means the service can add new restore points but cannot alter old ones.

The recovery window is configurable per policy. Your choices are three months, six months, one year, or two years. Existing policies default to one year. Restore points are frequent too. For a full SharePoint site or OneDrive account, you get a restore point every ten minutes for the prior two weeks. File and folder restore points are roughly daily in that window. After that, weekly snapshots run from two to 52 weeks back.

Billing is where people get caught. Microsoft 365 Backup is pay-as-you-go, not a per-user license. At the time of writing, Microsoft Learn lists the rate at 0.15 US dollars per gigabyte per month. Restores are free. Because it is pay-as-you-go, you need an Azure subscription and resource group in the same tenant. You also need a billing policy in the Microsoft 365 admin center. One warning from the docs: only disconnecting the payment method stops billing. Reaching your budget alert does not pause the service. Prices change, so confirm the current rate on Microsoft Learn before you plan a budget.

A few more useful facts. If you ever offboard, a 90-day grace period lets you recover your backups. Microsoft 365 Backup is now available for Government Community Cloud. It also supports Multi-Geo tenants across both central and satellite locations.

Microsoft 365 Archive: Cold Storage That Stays in Place

Microsoft 365 Archive moves inactive SharePoint sites and files into a cold storage tier. Crucially, it keeps them inside SharePoint. The site keeps its metadata, permissions, and searchability, and you can reactivate it later. Microsoft files this under content lifecycle. The site lifecycle management policies in SharePoint Advanced Management can even move sites into the archive tier automatically.

The pricing model rewards cleanup. At the time of writing, archived storage is billed at 0.05 US dollars per gigabyte per month. Standard storage over quota costs 0.20. Better still, the archive meter only charges you once your archived plus active storage exceeds your licensed SharePoint quota. Below that quota, archived data adds no cost. Reactivation of archived SharePoint content is also free now, since Microsoft removed that fee in March 2025. Unlicensed OneDrive accounts are the exception, and they still carry a reactivation charge.

The limits matter too. Some site types cannot be archived, including publishing sites and certain legacy templates. Sites with private or shared Teams channels are only partially supported. You cannot archive them from the SharePoint admin center, though PowerShell or Graph can archive the main site. Certain file types are excluded as well, such as OneNote, SharePoint pages, and SharePoint agents. Finally, once you reactivate content, you cannot archive it again for about four months. Plan around that before you reactivate a large site.

Version History: The Everyday Safety Net

Version history is the resilience feature you already use without thinking about it. It is part of Microsoft’s built-in data protection in SharePoint and OneDrive. When a file changes, you can view a previous version, restore it, or see who changed what.

It is also your first line of defense against small disasters. An accidental overwrite can often be undone by rolling a file back to a clean version. The same is true for many ransomware changes. Backup handles the big recovery scenarios, while version history handles the everyday ones.

Multi-Geo: Keeping Data in the Right Country

Multi-Geo lets one Microsoft 365 tenant store data in multiple geographies to meet data residency needs. A user’s data lives in a preferred data location, and admins manage it all from a single tenant. In the episode, Dave showed the agent starting to track geo moves. So when someone changes countries, you can follow the move from one place. The related agent prompts for cross-geo moves are still in preview, so treat that tracking as early.

Licensing is the big catch here, because Multi-Geo is a separate paid add-on. You buy it through an Enterprise Agreement, Web Direct, or CSP. It layers on specific base plans, such as Microsoft 365 F1, F3, E3, E5, and E7. Equivalent Office 365, SharePoint, OneDrive, Exchange, and Teams plans also qualify. Small Business plans do not. There is also a minimum. Enterprise Agreement and CSP customers must buy Multi-Geo for at least five percent of their eligible users. One more note from the docs: tenants that use Multi-Geo fall outside the EU Data Boundary scope.

Licensing and Availability, Product by Product

This episode is the trickiest in the series for licensing, because each piece is billed differently. Here is the short version.

First, the SharePoint Admin Agent itself needs SharePoint Advanced Management. That means a qualifying base plan, plus one of three things. You need a Microsoft Copilot license, the SharePoint Advanced Management Plan 1 add-on, or Microsoft 365 E7. The agent itself requires the SharePoint Advanced Management Administrator role.

After that, the resilience features are on their own terms. Baseline Security Mode is included on all plans. Microsoft 365 Backup and Microsoft 365 Archive are pay-as-you-go. So they need an Azure subscription and a billing policy, not a license tier. Multi-Geo is the separate add-on described above.

Government and sovereign clouds are a mixed picture, so check your own environment. Microsoft Learn documents Backup and Archive for commercial and Government Community Cloud tenants. It does not list them for GCC High, DoD, or the 21Vianet cloud in China. So do not assume coverage there. Multi-Geo is offered in the commercial geographies listed on Microsoft Learn. The sovereign clouds are not part of that list.

Bring Resilience Into Your Governance Plan

SharePoint content resilience is not a single product. At its core, it is Baseline Security Mode, Backup, and version history. Archive and Multi-Geo sit close by, and the SharePoint Admin Agent is starting to tie them together. Start by confirming what you actually have licensed. Then decide which gaps are worth closing.

If you want the bigger picture, my guide to the five pillars of Microsoft 365 content governance puts resilience in context. To automate the move of stale sites into the archive tier, see SharePoint site lifecycle management. And for everything the suite added this year, read what is new in SharePoint Advanced Management for 2026.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

SharePoint Site Access Reviews: A Practical Guide

Vlad Catrinescu — Tue, 01 Sep 2026 00:05:04 GMT

SharePoint Site Access Reviews solve a genuinely hard governance problem. As an admin, you can see that a site is overshared. However, you usually cannot see the files inside it. You also rarely know whether that broad access is a real problem or just how the team works. The people who do know are the site owners. SharePoint Site Access Reviews, a feature of SharePoint Advanced Management, let you hand the cleanup to those owners. Better still, you never look at their file-level content yourself. In this guide, I break down how the reviews work, what the site owner sees, and the limits to plan around.

Key takeaways

Site Access Reviews let IT admins delegate oversharing cleanup to site owners, who review and update permissions on their own sites.
In a site access review, admins do not see file-level or item-level detail, which keeps it inside compliance boundaries.
You can start reviews for up to 100 sites from the web view, and PowerShell handles anything larger.
Reviews cover SharePoint sites only, not OneDrive, and are unavailable on Microsoft 365 operated by 21Vianet.
Restricted Content Discovery and Restricted Access Control are sibling controls, and both can be delegated to site admins.

What Are SharePoint Site Access Reviews?

A SharePoint Site Access Review hands a data access governance report to a site owner for cleanup. In other words, the admin flags a potentially overshared site, and the owner does the actual work. The feature lives in the SharePoint admin center, under Data access governance.

The design answers two problems at once. First, compliance rules stop IT admins from seeing the file-level or item-level details in these reports. Second, site owners understand their own content far better than any central admin could. As a result, the owner is the right person to decide who keeps access.

Having worked with SharePoint environments for over a decade, I can tell you this is a meaningful shift. For years, oversharing cleanup landed entirely on the admin. Now the workload moves to the people closest to the data.

Why Delegate Reviews to Site Owners?

The honest answer is scale. I recently sat down with Dave Minasyan, a Principal Product Manager at Microsoft who leads SharePoint Advanced Management. He put it plainly. Many organizations run one SharePoint admin for a thousand users, or even hundreds of thousands. One person cannot know who should access every site.

Delegation fixes that imbalance. The admin still decides which sites need attention. However, the owner makes the call on individual files and permissions. Dave framed the goal as scaling the admin, not replacing them. The admin stays the pivotal person who directs the work, while owners handle the details.

How a Site Access Review Works

The admin side is straightforward. First, sign in to the SharePoint admin center. Next, expand Reports and select Data access governance. Then choose a supported report, select the sites you want reviewed, and select Initiate site access review. Finally, customize the email and send it.

Microsoft documents these supported reports for reviews:

Sharing link reports (Anyone, People in your organization, and Specific people shared externally)
Content shared with “Everyone except external users”
Oversharing baseline report using permissions

Two limits matter here. You can start reviews for up to 100 sites directly from the web view. For a larger batch, you use the Start-SPOSiteReview PowerShell command instead. In addition, one report has a monthly cap. The “Site permissions across your organization” report allows up to 1,000 reviews per calendar month.

Each request becomes an email tailored to the specific issue. For example, a review for the “Everyone except external users” report focuses only on that concern. Dave described the batching benefit well. Instead of fifteen separate emails for fifteen sites, an owner receives one consolidated request. He also noted that the notifications are grouped by category. As a result, an owner typically gets one email for oversharing and one for lifecycle, rather than a flood. Microsoft’s docs confirm the per-report tailored email; the category grouping is how Dave described it.

Once you send a review, you track it from the My review requests tab. The status stays “pending” until the owner finishes. After completion, the reviewer’s name and a timestamp appear. If the owner’s email is invalid, the review is marked as failed.

The Site Owner Experience and the Governance Hub

When a review starts, the site owner receives an email with a link to a detailed review page. That page is scoped to the exact issue the admin flagged. The owner never has to hunt through the whole site.

On that page, the owner can act in two areas. First, they can review SharePoint groups to see which ones contain “Everyone except external users.” Then they remove that group where it does not belong. Second, they can review individual files, folders, and lists shared broadly in the last 28 days. A Manage access button lets them remove users, adjust group membership, delete links, and change permissions. When the work is done, the owner selects Complete review, adds comments, and submits. Those comments flow back to the admin automatically.

Microsoft also gives owners a single place to see everything asked of them. It is called the Site reviews page. Owners reach it two ways: from the review email, or from the site’s gear icon under Site settings. From there, they handle multiple pending reviews in one view.

This consolidated page is what Dave and I call the “Governance Hub” in the video. It is worth being precise here. Microsoft does not brand it that way today. In fact, Dave was candid that the name is not final. So treat “Governance Hub” as a useful shorthand for the owner’s consolidated review experience, not an official product name.

Site Access Review Limits You Should Know

Every governance feature has edges, and this one is no exception. Plan around these documented limits before you roll it out:

SharePoint sites only. Site access reviews currently do not support OneDrive accounts.
The 100-site web cap. You start up to 100 reviews from the web view, then move to PowerShell for more.
No file-level view in the review. Compliance keeps IT admins out of file-level and item-level detail here, which is exactly why owners run the review.
Not available on 21Vianet. Microsoft 365 operated by 21Vianet does not support site access reviews, even with the required licenses.
SharePoint Advanced Management license required. Site access reviews depend on it.

How Site Access Reviews Fit with RCD and RAC

Site Access Reviews are one part of controlling content access. Two policies sit alongside them: Restricted Content Discovery (RCD) and Restricted Access Control (RAC). They solve related but distinct problems, so it helps to keep them straight.

Restricted Content Discovery keeps a site’s content out of organization-wide search and Microsoft 365 Copilot discovery while you review it. It also removes AI entry points from the site. Examples include the Copilot button and the option to create agents or pages with AI. Importantly, RCD does not change permissions. People who already have access keep it, and RCD does not remove content from the search index. Think of RCD as protection that buys you time. The content stays usable for the right people, yet it will not surface in those experiences until you are ready. One caveat: the setting propagates across the index, so it is not instant. For very large sites, above 500,000 items, full effect can take more than a week. RCD applies to SharePoint sites only.

Restricted Access Control takes the stronger step of gating who can open a site at all. You point RAC at one or more groups, either Microsoft Entra security groups or Microsoft 365 groups. You can add up to 10 groups per site. People outside those groups cannot open the site or its content, even if they previously had a direct permission or a link. Members still need their own content permission as well. Search and Copilot honor the boundary too, though on large sites they can take time to reflect the change. One more gotcha: a policy on a Teams-connected site does not automatically cover its shared or private channel sites, which are separate site collections that need their own configuration. In short, RCD hides content from discovery, while RAC controls who can reach it.

Both controls can also be delegated to site admins, which matches how the review model works. RCD is the clearest example. An admin turns on delegation with a tenant setting, Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. After that, site admins manage the setting for their own sites and provide a justification for each change. This delegation is the feature Dave highlighted at the end of the interview. He noted it starts from PowerShell, which is accurate. The tenant toggle is a PowerShell command, while the per-site control lives in the UI.

Automating Reviews with the SharePoint Admin Agent

The SharePoint Admin Agent adds a conversational layer over all of this. It requires the SharePoint Advanced Management Administrator role. With it, an admin asks questions in natural language. One example: “Which sites are overshared and what are the risk levels for these sites?” The agent then gathers the data, offers analysis, and recommends next steps. Microsoft lists controlling access to content, including site access reviews, among the governance tasks the agent supports.

Dave went further and shared where this is heading. He described a future where the admin starts a review through the agent. The agent understands the intent behind it, and then helps the site owner take action. He also mentioned extending the agent to site owners. Those are roadmap ideas from the interview, not documented capabilities today, so treat them as direction rather than fact.

One design principle is worth calling out, because it explains the guardrails. Dave was clear that the agent runs “on rails.” It will not perform destructive actions like deleting sites. Archiving, on the other hand, is supported, because you can reverse it.

The archive numbers back that up. Microsoft 365 Archive keeps a newly archived site in a “Recently archived” state for seven days. During that window, reactivation is instantaneous. After seven days, reactivation can take up to 24 hours. On top of that, Microsoft eliminated the SharePoint reactivation fee on March 31, 2025. Reactivating an archived site is now free. Two caveats apply. Re-archiving reactivated content is blocked for four months. Also, the free reactivation does not extend to OneDrive accounts. So archive is a safe, reversible cleanup lever, which is the point Dave made.

Licensing and Availability

Licensing trips people up, so let me be specific. SharePoint Advanced Management needs one of these base subscriptions:

Office 365 E3, E5, or A5
Microsoft 365 E1, E3, E5, or A5
The GCC, GCC-High, and DoD equivalents

You then unlock SharePoint Advanced Management in one of three ways. First, assign at least one Microsoft Copilot license in the tenant. Second, add the SharePoint Advanced Management Plan 1 add-on to a SharePoint K, P1, or P2 subscription. Third, use Microsoft 365 E7, the Frontier Suite, which includes Copilot. For E3 and E5 tenants, the Copilot add-on is the usual route.

There is one nuance worth calling out. An admin with Microsoft 365 E5 alone can access Data access governance reporting. However, the other SharePoint Advanced Management features stay locked. In that E5-only state, you get no snapshot reports and no remedial actions. Activity reports also return up to 10,000 sites. In practice, full Site Access Reviews need SharePoint Advanced Management, not E5 by itself.

Finally, the 21Vianet exclusion is broad. All three features are unavailable on Microsoft 365 operated by 21Vianet: Data access governance reports, site access reviews, and Restricted Access Control reports. That holds even when the required licenses are present.

Where to Go Next

Site Access Reviews are the collaborative side of content access governance. They pair naturally with the reports that find oversharing and the policies that contain it. As a Microsoft MVP who works with organizations on their rollouts, I’ll keep my advice simple. Start with a small set of sites. Learn the owner experience, then scale.

Want to get your tenant Copilot-ready? Start with the reports that surface the risk, then delegate the cleanup with Site Access Reviews. For the bigger picture, read three related posts. My overview covers what is new in SharePoint Advanced Management for 2026. You can also read the five pillars of Microsoft 365 content governance and where to begin with a SharePoint content assessment.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

SharePoint Agent Governance: Monitor and Control Access

Vlad Catrinescu — Tue, 01 Sep 2026 00:04:37 GMT

SharePoint agent governance is not about switching agents on and off. It is about controlling what your agents can reach once they exist. That distinction trips up almost every admin who opens the agent reports for the first time. Microsoft’s own product team goes out of its way to correct it. Here I cover the two reports that share a menu, what each one measures, the policy levers you have today, and where those levers stop working.

Key takeaways

SharePoint Advanced Management governs what agents can access. Agents in SharePoint do not require activation, so there is no per-agent on switch in SharePoint itself.
Two different reports sit under Reports > Agent insights. One counts agents created, the other tracks agents accessing content. They read different audit events and use different cmdlets.
The agent access report shows the top 100 sites, and the top 20 agents for any single site. Downloaded reports scale to 1 million sites.
Two policies apply directly from the report: Restricted Content Discovery and Restricted Access Control. Restricted Content Discovery works on SharePoint sites only.
You need SharePoint Advanced Management either way. If your entitlement comes from a Microsoft Copilot license rather than the add-on SKU, you must also switch on audit data collection before any report will run.

What SharePoint agent governance actually controls

Start with the boundary, because it explains everything else. SharePoint Advanced Management does not turn agents on or off. It governs the content those agents can reach.

Dave Minasyan, Principal Product Manager at Microsoft, stopped mid-demo to make this point. Customers kept misreading the report:

I want to emphasize the fact that we are not managing agents in the sense where you can turn on off an agent in SharePoint. What we’re managing is what these agents can have access to.

Microsoft documents that agents in SharePoint do not require activation, so there is no per-agent switch inside SharePoint. There are still user-level controls, though, and they are easy to miss. You govern who can use agents through Microsoft Copilot license assignment. Admins can also turn the Microsoft Copilot for SharePoint service plan off for an individual user. That disables agents in SharePoint for them, along with Copilot in OneDrive and SharePoint page authoring. Organizations on pay-as-you-go billing scope access through the security group attached to the billing policy instead.

Separately, there is a block control in the Microsoft 365 admin center, under the Agents section of the Copilot Control System. That area was formerly known as integrated apps.

Blocking behaves differently depending on how the agent was built, and Microsoft’s two pages read differently on this. The SharePoint documentation says flatly that blocking affects only availability in Copilot Chat, and does not yet apply to OneDrive, SharePoint, or Teams. The Microsoft 365 admin center documentation is narrower. It scopes that Copilot Chat limit to agents created in SharePoint or Microsoft Foundry, and says blocking an Agent Builder or Copilot Studio agent also reaches Outlook, Teams, and other Microsoft 365 apps. Assume the Copilot Chat behavior for agents built in SharePoint, and test before relying on it elsewhere.

Dave’s mental model for the rest is simple. It is his framing rather than a Microsoft definition:

The way I look at agents is essentially it’s just another type of a file.

This is where the documentation gets genuinely confusing, so it is worth slowing down. Two separate reports live under Reports > Agent insights in the SharePoint admin center. Their names are nearly identical. Their data is not.

	Insights report on agents in SharePoint	Agent access insights report
Measures	Agents recently created	How agents access content
Audit signal	FileCreated and FileRenamed events	Reading, searching, and interacting
Where	Reports > Agent insights	Reports > Agent insights > Agent access
Generate with	`Start-SPOCopilotAgentInsightsReport`	`Start-SPOM365AgentAccessInsightsReport`
Download with	`Get-SPOCopilotAgentInsightsReport -ReportId -Action Download`	`Export-SPOM365AgentAccessInsightsReport -ReportId <ReportId> -Action Download`
Answers	Which sites spawn the most agents	Which agents read which sites

Both reports draw on Microsoft 365 unified audit data. They differ in which events they read, not in the underlying source.

The access report is the one Dave demonstrates. It is also the one that matters most for SharePoint agent governance. Knowing an agent was created tells you little. Knowing it read a finance site last Tuesday tells you a lot.

One documentation wrinkle to know about. The access report page describes its main view as sites “hosting the highest number of agents”, which is really creation-report language. Read that column as agent presence on the site. The top 20 view per site is the reliable access signal.

What the agent access insights report shows you

The report covers registered and activated agents across every SharePoint and OneDrive site in the organization. Microsoft names three categories explicitly, then adds “and more”. Those three are agents created in SharePoint, declarative agents, and custom agents.

In the browser, you get three views. First, a list of the top 100 sites. You can filter that list by site template and by governance policy. Second, the top 20 agents accessing any single site you select. Third, a distribution view split into Unique Agents found in SharePoint Sites or Unique Agents in OneDrive Account.

That third view is the heat map Dave calls his favorite part of the area. Both the browser and PowerShell cap their display at 100 sites. A downloaded report, however, can contain up to 1 million sites. Exports are therefore where large tenants should live.

The limits nobody mentions on camera

These are documented, and they shape how you schedule the work:

Report durations are fixed at 1, 7, 14, or 28 days.
Only one report can exist per duration, so you can hold a maximum of four at a time.
Generating a new report for a duration replaces the previous one. Download first if you want to keep it.
You can only run a report 24 hours after the last one generated.
On large tenants, data can take up to 48 hours to become available.
Reports draw on unified audit data, which Microsoft notes might not include every audit event.

One more catches people out. Apply a policy to a site directly from the report, and the policy status on that existing report does not refresh. Select the policy to see its latest status, or open the site’s Active site panel and check the settings there.

Turning on data collection

If your SharePoint Advanced Management entitlement comes from a Microsoft Copilot license rather than the add-on SKU, you have to switch collection on first. The cmdlets differ between the two reports, which is easy to get wrong.

For the agent access report:

Start-SPOAuditDataCollectionForActivityInsights -ReportEntity M365AgentInsights
Get-SPOAuditDataCollectionStatusForActivityInsights -ReportEntity M365AgentInsights

For the creation report, run the same cmdlets without -ReportEntity. Status comes back as NotInitiated, InProgress, or Paused, and you can generate reports once it reads InProgress.

Which agents actually show up

Microsoft’s documented list has three entries, as above. On camera I added a fourth practical category, and that grouping is mine rather than Microsoft’s published taxonomy. An agent carrying its own Microsoft Entra agent identity was provisioned through a registered blueprint. That tells you something about how it was created, though not necessarily that a developer built it, because Copilot Studio creates agent identities too.

The underlying model is worth knowing. Microsoft Entra Agent ID represents an agent identity as a service principal with servicePrincipalType set to ServiceIdentity. Three object types make up the model. Those are an agent identity blueprint, the agent identity itself, and an optional agent’s user account. That third object is currently available only to tenants in the Frontier preview program.

Agent identities hold no credentials of their own. They can also only be issued tokens in the tenant where they were created. One documented cap applies as well: non-Microsoft management platforms using app-only permissions are limited to 250 agent identities per blueprint. Delegated calls and Microsoft-owned platforms such as Foundry and Copilot Studio are exempt.

Restricted Content Discovery is the main lever, and it has edges

Spot an agent you do not recognize, and Restricted Content Discovery is what most admins reach for. Two policies apply directly from the agent access report. The other is Restricted Access Control, which limits site access to users in up to ten specified Microsoft 365 or Microsoft Entra security groups.

Here is what Restricted Content Discovery does. It limits discovery of a site’s content in organization-wide search and in Microsoft Copilot responses. It also strips the AI entry points out of the site. Users no longer see the Copilot button, the AI actions menus including agent creation, or Create pages with AI. A Restricted tag then appears on the site.

Here is what it does not do. This list is the more useful half:

It does not change permissions. Anyone with access keeps their access.
It does not remove content from the Microsoft 365 search index, so Purview eDiscovery and auto-labeling keep working.
It does not affect searches that originate from site context, nor Microsoft 365 Feed and Recommendations.
It does not work on OneDrive. Microsoft supports it for SharePoint sites only.

On camera, I asked Dave the obvious follow-up. His answer was one word:

But you block it at the site level, not the agent level. Correct?

Correct.

That holds for this lever. You restrict the site an agent is reading, which buys you time to investigate. Microsoft frames the feature the same way. The documentation describes it as a temporary governance control rather than a permanent posture. It also cautions that excessive use can reduce the content available to organization-wide search and to Copilot, which affects the completeness and relevance of results.

Timing matters too. The setting has to propagate across indexing systems. Microsoft documents that sites with more than 500,000 items can take more than a week to fully reflect the change.

Delegation is available if you want site administrators to manage it themselves. Turn it on with Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. Site administrators must then supply a justification whenever they change the setting.

Licensing and availability limits

Check this before you plan anything. The entitlement is easy to assume and easy to get wrong.

You need a qualifying base subscription first. Microsoft lists Office 365 E3, E5, or A5; Microsoft 365 E1, E3, E5, or A5; and Microsoft 365 GCC, GCC-High, or DoD. A base license alone is not enough, though. On top of it, one of three conditions must be true:

At least one user in the organization is assigned a Microsoft Copilot license. That user does not need to be an administrator.
Your subscription includes SharePoint K, P1, or P2, and you buy the SharePoint Advanced Management Plan 1 add-on.
Your organization has Microsoft 365 E7, the Frontier Suite. It bundles Microsoft 365 E5, Microsoft Copilot, Microsoft Entra Suite, and Microsoft Agent 365.

Those three routes are not equivalent. Microsoft documents some features, restricted site creation among them, as requiring the Plan 1 add-on regardless of Copilot licensing.

Microsoft 365 E5 on its own is the trap. Microsoft documents that E5 administrators can access data access governance reporting, but cannot view or use the other SharePoint Advanced Management features. Those E5 reports also come without snapshot reports and without remedial actions, and activity reports return only up to 10,000 sites.

Restricted Content Discovery carries its own requirement on top. Microsoft lists a Microsoft Copilot license as a prerequisite, because the feature is intended for Copilot deployment and governance scenarios.

For roles, you need either SharePoint Administrator or the broader SharePoint Advanced Management Administrator role. The SharePoint Admin Agent is stricter. It requires the SharePoint Advanced Management Administrator role specifically, and your organization must have SharePoint Advanced Management.

Government clouds deserve a separate look. For Copilot-licensed tenants, Microsoft documents Restricted Content Discovery and Restricted Access Control as available across commercial, GCC, GCC-High, and DoD. That same table lists a row called SharePoint agent insights, but it links to the Get AI insights button rather than to either agent report. Neither agent report has its own row, so treat their government cloud availability as undocumented rather than confirmed.

Microsoft 365 operated by 21Vianet needs care. Microsoft flags three exclusions outright, in each case even with the required licenses. Data access governance reports are unavailable there. Site access reviews are unsupported. Restricted access control reports are unavailable too. The agent insights pages carry no equivalent note. Treat 21Vianet as unconfirmed for agent reporting and check with your account team.

What is not there yet

This is the part where the recording has aged, so lead with the documentation.

Microsoft now publishes a SharePoint Admin Agent prompt that returns exactly this data. It reads: Show me a list of the top 10 agents that are accessing my SharePoint and OneDrive content. So some integration already exists. On camera Dave described that integration as still being worked towards, which was accurate when we recorded and is now partly overtaken.

The same applies to oversharing. Microsoft documents data access governance reports as a current SharePoint Admin Agent capability, not a future one. Dave presented it as coming.

His caution about file-level data still holds, and Microsoft gives a reason for it. Site access review documentation states that compliance reasons prevent administrators from accessing file-level or item-level details.

Owner and creator details remain undocumented. Dave noted the team is working on surfacing the agent owner, and it was not yet displaying during the demo. That one is his statement rather than a published commitment.

Where to go next

Ready to see which agents are already reading your content? Open the SharePoint admin center, expand Reports, select Agent insights, then select Agent access. If you have never generated one, start with a 28-day report so you have a full window to look at. Remember you cannot regenerate it for another 24 hours.

Good SharePoint agent governance starts with knowing what is out there. For the wider picture of what shipped this year, read my breakdown of what’s new in SharePoint Advanced Management for 2026. If you need to find agents across the whole tenant rather than just SharePoint, my write-up on Microsoft’s unified agent inventory covers the Microsoft 365 admin center side. And if your reports come back as an undifferentiated wall of sites, SharePoint catalog management is the piece that gives them structure.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

SharePoint Oversharing Reports and the New SAM Admin Role

Vlad Catrinescu — Tue, 01 Sep 2026 00:04:11 GMT

SharePoint oversharing reports used to stop at the site. Now they reach the individual file. Running one also takes a brand new admin role, and not even a global administrator holds it by default. Here is what changed, what the export contains, and who should be allowed to open it.

Key takeaways

One feature covers two runnable reports, one for content shared with Everyone and one for content shared with Everyone except external users.
Both require the SharePoint Advanced Management Administrator role. A global admin must assign it explicitly, even to themselves.
Microsoft tells you to generate the site permissions report at least once first. Treat that as a prerequisite.
Each download is a ZIP containing a CSV, capped at 1 million rows. You can only rerun a report every 30 days.
The export includes a TotalUserCount column that separates who can reach a file from who actually has.
Microsoft 365 E5 without SharePoint Advanced Management does not get snapshot reports, so this report is out of reach on E5 alone.

The Five Types of SharePoint Oversharing

Oversharing sounds like one problem. In practice, it arrives in a handful of recognizable shapes.

Dave Minasyan is the Principal Product Manager for SharePoint Advanced Management at Microsoft. He groups those shapes into five basic types. By his estimate, those five cover roughly 80 to 90 percent of the oversharing patterns his team sees across tenants. Both the grouping and the figure come from the product team rather than from published documentation. Treat them as field observations, not measured statistics.

Microsoft Learn publishes no numbered “five types” list. What the documentation does give you is six risk signals worth watching for:

Broad sharing through “Anyone,” “Everyone,” and organization-wide links
Large audiences with excessive permissions
Broken permission inheritance and complex access models
Sensitive content with weak protection
Unlabeled or public sites
Governance gaps with ownerless, inactive, or unreviewed sites

The content management assessment uses a tighter grouping. It flags oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and sites that are inactive or ownerless. That maps almost exactly onto Dave’s five.

Microsoft also notes that risk compounds. Sites where several signals overlap deserve your attention first. A public site with no owner is a problem. A public site with no owner, sensitive data, and an “Anyone” link is an emergency.

Start With the Permission State Report

The permission state report remains the flagship tool, and everything else depends on it. Microsoft documents it as the site permissions for your organization report. It gives you a snapshot of your permission structure across every SharePoint and OneDrive site.

The report counts total permissioned users, Microsoft Entra groups, and broken inheritance. It also counts EEEU permissions, Everyone permissions, guest user permissions, external participant permissions, and sharing links. Microsoft generates separate reports for SharePoint and for OneDrive.

Several documented details rarely come up in conference sessions. Each one affects how you plan:

The first report takes up to 5 days, regardless of tenant size. Later runs finish within 24 hours.
Reports capture data from up to 48 hours before generation, so the numbers are never live.
You can run reports again every 30 days.
The interface shows the top 100 sites by user count. The CSV download covers up to 1 million sites.
Sites with a NoAccess lock status are excluded, and so are archived sites.

The most useful idea in the documentation is the split between current and potential exposure. Adding users directly, or through a Microsoft Entra group, raises the permissioned user count immediately. Creating a sharing link does not, and neither does granting access to Everyone except external users. Those actions create potential exposure. It only becomes real when someone opens the content.

One more caveat matters if you audit classic sites. The EEEU and Everyone counts deliberately exclude hidden system files and system groups, because those permissions exist by design.

Where Microsoft Purview Fits In

Dave confirmed that his team is working with the Microsoft Purview team on a specific integration. The goal is to bring sensitive file type information directly into the permission state report. Once configured in Purview, that data would flow into the report and help you decide which sites deserve attention first.

That integration appears nowhere in the documentation, so treat it as roadmap rather than something usable today. Microsoft Purview does show up in the official guidance, but as a parallel tool you cross-reference by hand, not as a feed into this report.

What you can use today is the Site Sensitivity column already in the CSV. It carries the sensitivity label applied to the site itself, not to individual files. For file-level label data, Microsoft ships a separate sensitivity labels for files report. The SharePoint Advanced Management overview page calls the same thing the sensitivity label snapshot report, so expect both names.

SharePoint Oversharing Reports Now Reach the File Level

Site-level numbers tell you where to look. They do not tell you what to fix. Admins have asked Microsoft for file-level detail for years, and it has now shipped.

The feature is called Sites and files shared via special SharePoint groups. You will find it in the SharePoint admin center under Reports, then Data access governance, in the Snapshot reports area. It is one feature with two runnable reports, because each special group gets its own. Dave announced the “Everyone except external users” version on camera, and Microsoft shipped a matching report for the Everyone group alongside it.

Each row identifies a single item one of those groups can reach. You also get the full chain of identifiers, running from your tenant down to that item. Each row carries the permission level granted, plus the parent group when access is indirect.

There is no browsable data grid, and that is intentional. The admin center gives you a status tile showing that the report is available, the date it was generated, and the number of sites found. Everything past that lives in the download. As Dave explained it, these reports can be very massive, so Microsoft skipped the interface and went straight to the export. The documentation frames the same decision around outcomes. Use these SharePoint oversharing reports when you want to fix problems through scripting, rather than asking site owners to review permissions one site at a time.

What You Actually Get in the Export

The download is a ZIP file containing a CSV, and it is capped at 1 million rows. On camera, Dave estimated that a permission report “can have like a million rows.” That turns out to be the documented ceiling rather than an exaggeration.

The CSV carries 20 columns. Most are identifiers that form a hierarchy from your organization down to a single item. As a result, you can pivot or summarize at any level. Filter on one site ID and you see every permission inside that site, across every scope.

A few columns deserve specific attention:

ItemType tells you what the row describes: Web, List, Folder, or File. List items count as files.
Role definition gives the permission level, such as Full control, Read, Edit, Contributor, Creator, or Viewer.
ParentGroupType and ParentGroupName appear when access is indirect. Together they show whether the path runs through a security group, a SharePoint group, or a Microsoft 365 group.
TotalUserCount is the column most people will miss. It counts users who have actually opened the item at least once.

That last column turns an intimidating list into a prioritized one. The item is already shared with everyone internally, so this number is your real exposure rather than your theoretical exposure. Ten thousand overshared files nobody has ever clicked is one problem. Fifty overshared files that hundreds of people have opened is a very different one.

Four constraints are worth knowing before your first run. Microsoft tells you to generate the site permissions report at least once beforehand, though the documentation never spells out what happens if you skip that step. Data can be up to 48 hours old. You can only rerun it every 30 days. Finally, the report always covers both SharePoint and OneDrive, and you cannot scope it to one workload.

Licensing is the constraint that stops most people, and it is easy to miss. Microsoft states that E5 administrators can reach data access governance reporting without SharePoint Advanced Management. Those reports, however, do not include snapshot reports or remedial actions. This is a snapshot report, so E5 alone will not get you there. The reports are also unavailable for Microsoft 365 operated by 21Vianet, even with the right licenses.

The report also excludes system files and system groups. Microsoft gives a concrete example: the Everyone group inside the Style Resource Readers group on classic publishing sites. That membership is intentional, since it controls access to the master page gallery and the style library. Remove it, and users start seeing broken pages.

The New SharePoint Advanced Management Administrator Role

File-level visibility arrived with a new security model attached. The SharePoint Advanced Management Administrator role is a built-in Microsoft Entra role. Microsoft documents it as a superset of SharePoint Administrator.

Assign it, and the holder can do everything a SharePoint Administrator does, plus three things a SharePoint Administrator cannot:

View names, paths, and URLs of files, folders, libraries, documents, and lists inside SharePoint sites
Remove permissions from those same objects
Manage SharePoint Advanced Management features

One boundary deserves more attention than it usually gets. The role grants visibility into file names, paths, and URLs without granting access to file or item content. An admin can see that a file called “2027 Layoff Plan.docx” is shared company-wide, and they can strip that permission. The role alone does not let them read it.

Because the role is a superset, you do not need both. If you are the only SharePoint admin at your company, take this role and drop the other one. In a larger team, treat the split as a deliberate decision about who sees file names.

Why Global Admins Have to Opt In

Here is the part that surprises people, and I confirmed it in my own demo tenant before publishing. A global administrator cannot run the file-level report. Microsoft documents the same behavior plainly. Standard SharePoint administrators and global administrators cannot view file properties across sites they do not own. A global administrator must assign the SharePoint Advanced Admin role before the report will run.

You can, of course, grant the role to yourself, since you are the global admin. The point is that you make that choice consciously, and the choice is auditable.

I described this to Dave as the Microsoft Purview model, where even a global admin starts with nothing by default. He pushed back on the framing. In his view, it is not a Purview pattern at all. It is a general data compliance requirement, and it applies the moment any tool starts touching files rather than sites. His reasoning was blunt. Whoever holds this role could potentially see file names inside a chief executive’s own content, and that is not access you hand out by default.

Having spent over a decade in SharePoint environments, I would argue the distinction is academic for most admins. Purview works this way precisely because compliance demands it. Dave is right on the technicality, though. That technicality is exactly why this role exists as a separate assignment rather than a checkbox.

What This Means for You

Start by running the site permissions report, because nothing else works until you do. It is a hard prerequisite for the file-level reports. On a first run, it can take up to 5 days, so kick it off before you need the data.

Next, decide who holds the SharePoint Advanced Management Administrator role. Decide it before someone urgently needs a report. If you are a one-admin shop, this is simple. Take the role, since it includes everything your current role does. If you have a team, have the conversation about file-name visibility while it is still hypothetical.

Then plan your cadence around the 30-day rerun limit. A quarterly rhythm works well for the snapshot reports. Pull the file-level export ahead of any significant Copilot or agent rollout. Remember that the data is already up to 48 hours old when it lands. These SharePoint oversharing reports are a planning instrument, not a monitoring one.

Finally, sort out your analysis path before the CSV arrives. A million-row file is not something you skim. Excel with Copilot, Power BI, or a short script will all work. Dave was direct about why Microsoft chose the CSV format: admins who need file-level data already know how to handle large exports. File-level data is not in the SharePoint Admin Agent yet, though Dave said bringing it in is on the roadmap.

Ready to find out where your own oversharing lives? Open the SharePoint admin center, go to Reports, then Data access governance. Check whether your site permissions report has ever been generated. That one answer tells you whether the file-level reports are available today or five days from now. For the wider picture of what shipped this year, read my breakdown of what’s new in SharePoint Advanced Management for 2026. To scope reports to a department instead of your whole tenant, start with SharePoint catalog management. And if your next step is keeping sensitive sites out of Copilot, see my first look at Restricted Content Discoverability.

Dave reads the comments on these interviews personally. If you have a feature request for SharePoint Advanced Management, that is the place to leave it. You can also connect with Dave Minasyan on LinkedIn. For more Microsoft 365 governance coverage, subscribe to the Vlad Talks Tech newsletter at vladtalkstech.com.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

SharePoint Site Lifecycle Management: A Practical Guide

Vlad Catrinescu — Thu, 20 Aug 2026 18:45:11 GMT

Every SharePoint tenant accumulates sites nobody opens anymore. A project wrapped up two years ago. The owner has since left the company. Meanwhile the site sits there, consuming storage and feeding search results nobody wants. SharePoint site lifecycle management fixes that. It is a set of policies in SharePoint Advanced Management that finds those sites and acts on them automatically. No PowerShell required.

Having worked with SharePoint environments for over a decade, I can tell you this. The hard part was never spotting the problem. It was doing anything about it at scale. These policies close that gap.

Key takeaways

Site lifecycle management includes three policy types: inactive site, site ownership, and site attestation. Each one solves a different governance problem.
Every policy runs in simulation mode, which reports without acting, or active mode, which runs monthly and enforces.
Enforcement escalates through three monthly notifications, then optionally read-only, then optionally archive through Microsoft 365 Archive.
Policies never delete sites. That is a deliberate design decision, not a limitation.
You can exclude up to 100 entries from notifications, but group exclusions have a catch that surprises most admins.

What SharePoint Site Lifecycle Management Actually Does

SharePoint site lifecycle management policies monitor sites, notify the people responsible for them, collect responses, and take enforcement action when nobody replies. They live in the SharePoint admin center under Policies. They also require SharePoint Advanced Management, which is included with Microsoft 365 Copilot licenses.

The critical thing to understand first: these policies do not delete sites. Microsoft designed them to notify, escalate, and archive, never to destroy. Archiving is reversible. Deletion is not, and Microsoft deliberately kept that out of the automated path.

That design choice matters more than it sounds. It is why you can turn these policies on without fear. A misconfigured scope will not quietly remove the legal team’s site over a long weekend.

The Three Policy Types and When to Use Each

Microsoft ships three policy types, and they are genuinely different tools rather than three flavors of the same thing.

Inactive Site Policies

Inactive site policies find sites that show no meaningful business activity for a period you define. When a site crosses that threshold, the policy notifies the owners or admins. It asks them to confirm the site is still needed. If someone selects Certify site in the notification email, site lifecycle management stops checking that site’s activity for a full year.

Use these to reduce content sprawl and reclaim storage.

Site Ownership Policies

Site ownership policies check that every site has enough accountable people attached to it. You define whether the requirement counts site owners, site admins, or both, and you set the minimum number. Require two owners per site, and any site that drops below that triggers the policy.

This one quietly matters most. Dave Minasyan is the Principal Product Manager who leads SharePoint Advanced Management at Microsoft. As he put it in our conversation, all of this governance rests on somebody actually owning the site. Admins can see there is a problem. However, they rarely know the content well enough to judge whether it is a real one. Only the owner can make that call.

Site Attestation Policies

Site attestation policies ask owners to review a site on a recurring schedule. Is it still needed? Is it still configured correctly? You choose a cadence of 3, 6, or 12 months.

The distinction from inactive site policies is worth internalizing. Inactive site policies react to measured activity. Attestation policies request a human judgment regardless of how busy the site looks. A site can be extremely active and still be a governance problem.

Dave’s framing was the clearest I have heard: attestation is the proactive policy, and the other two are reactive. Run attestation properly and far fewer inactive and ownerless sites pile up in the first place.

How SharePoint Decides a Site Is Inactive

This is where most people guess wrong. Inactive site policies do not just watch SharePoint. They evaluate activity across connected Microsoft 365 workloads. So a site backing an active Team will not be flagged just because nobody opened the document library.

Workload	Activity that counts
SharePoint	Viewed, edited, shared, or synced files, viewed and visited pages
Microsoft Teams	Channel messages, replies, mentions, reactions, meetings
Viva Engage	Posted messages, read conversations, liked messages
Exchange	Emails received in the group mailbox

Several site types sit permanently out of scope: OneDrive sites, root sites, home sites, app catalog sites, tenant admin sites, sites created by system users, and sites tied to shared or private Teams channels.

There is one trap worth flagging. App activity through an app token never counts as activity. PnP PowerShell activity through a user token does not count either. So if an automation job is the only thing touching a site, the policy reads it correctly. No human is using it.

One more detail catches people out. When a site owner clicks the site URL in a notification email, that visit does not count as activity. Neither do any read actions in the following hour. Only edits reset the clock.

Simulation Mode: See the Impact Before You Commit

Every site lifecycle management policy runs in one of two modes. Simulation mode runs the policy once and produces a report without enforcing anything. Active mode runs monthly, sends notifications, and applies whatever enforcement you configured.

The part that makes simulation genuinely useful is that your configured actions are preserved rather than stripped out. You build the policy exactly as you intend to run it, notification schedule and enforcement action included. Simulation mode then reports what would have happened, without doing any of it. When you are satisfied, you activate, and the policy starts executing the configuration that was already sitting there.

Dave described this as the safest way to run these policies, and I agree. There is no reason to activate a policy on day one. Run it in simulation, read the report, then decide.

What Happens When Nobody Responds

All three policy types share the same escalation pattern, and it is more patient than most admins expect.

Enforcement action	What actually happens
Do nothing	Three monthly notifications, then six months of silence, then notifications resume if the site is still uncertified. Report flags the site as unactioned.
Read-only access	Three monthly notifications, then the site goes read-only. A banner appears on the site and owners cannot lift it themselves.
Archive after read-only	Three monthly notifications, then read-only for 3, 6, 9, or 12 months, then archival through Microsoft 365 Archive.

Archiving requires Microsoft 365 Archive to be enabled in your tenant, and only tenant admins can reactivate an archived site. Is archiving new to you? Work out whether Microsoft 365 Archive actually saves you money before you wire it into an automated policy.

Read-only sites can be released from the Active sites page using Unlock. That is the same mechanism covered in my guide to locking and unlocking SharePoint sites.

Keeping Executives Out of the Notification Queue

Your CEO is probably a member of half the sites in your tenant. Nobody wants a governance rollout that opens with a thousand automated emails to the leadership team.

The exclusion list handles this. You can exclude specific users, Microsoft 365 Groups, or security groups from lifecycle notifications. The cap is 100 entries per policy. A group counts as one entry no matter how many members it has.

Two things about exclusions consistently surprise people, and both are documented:

First, exclusions only affect who gets notified. The site is still evaluated by the policy and still subject to enforcement. Excluding a user does not exclude their sites.

Second, and this is the one that bites. A group exclusion only applies when that group is directly added to the site, or nested inside a group that is. Is that person also added to the site individually? Or a member of some other group on the site? Then they still get the notification.

What Happens When Policies Overlap

If you create several policies of the same type, SharePoint will not send duplicate notifications. Say a policy of that type already notified within the last 30 days, and the site is still uncertified. No further notification goes out. The execution report marks the site as Notified by another policy.

That is a helpful safety net, but Microsoft’s own guidance is to avoid overlapping scopes within a policy type entirely. Overlap makes the notification schedule and enforcement timing unpredictable. That is the last thing you want in a process people are supposed to trust.

What Dave Minasyan Says Is Coming Next

Everything above is generally available today. The following comes from my conversation with Dave, not from Microsoft’s documentation. Treat it as a roadmap rather than fact.

Catalog scoping for policies. Catalog management already lets you organize sites into categories such as department or locale. Dave described extending that to policies. You could then point an inactive site policy at the finance department instead of the whole tenant. Microsoft’s documentation still lists only two scope options: sites at scale, or a CSV of up to 10,000 URLs. So this has not landed in the docs yet.

A cap of five inactive site policies. I asked Dave directly whether that limit would rise to match the number of catalog categories an organization might create. He confirmed the cap stands. For now, you have to get creative. Microsoft has heard the feedback repeatedly, but there is no ETA. This limit is not documented on Microsoft Learn.

Consolidated notifications and a governance dashboard. Instead of one email per site, owners would receive a single batched summary. A button takes them to one page listing everything the admin has asked them to do. Dave called this the governance hub on camera and noted the name might change before release. It has since surfaced on the Microsoft 365 roadmap as the Governance Reviews Dashboard, in private preview.

More frequent assessments. The content management assessment that feeds this data is monthly today. Dave said Microsoft is working on allowing more frequent runs, with an announcement to come.

For the wider picture, I broke down everything new in SharePoint Advanced Management for 2026 after speaking with Dave. I also mapped out the five pillars of Microsoft 365 content governance separately.

How to Roll This Out Without Scaring Yourself

Here is the sequence I would follow.

Start with a site ownership policy in simulation mode. Ownership is the foundation everything else depends on, and the report alone usually tells you something uncomfortable and useful.

Next, build your exclusion list before you activate anything. Leadership, service accounts, and anyone whose inbox becoming a governance queue would cost you political capital.

Then run an inactive site policy in simulation against a narrow scope rather than the tenant. Dave’s point about trust building is the right one. Admins in large organizations do not activate tenant-wide on day one, and they should not have to. Use the CSV scope option or a tight site template filter to keep the first run small.

Finally, layer attestation in once the reactive policies have cleared the backlog. Attestation is the policy that keeps the tenant clean rather than the one that cleans it.

In the demo tenant Dave walked through, the SharePoint admin agent surfaced 142 low-activity sites owned by Sales and Marketing. That tenant held 8,041 sites in total. Those are demo-tenant figures, not a real-world benchmark. Still, the ratio makes the point. Sprawl usually concentrates in a few departments rather than spreading evenly, which is exactly why scoped rollouts beat tenant-wide ones.

Ready to get your tenant under control? Start with a single site ownership policy in simulation mode this week and read the report before you change anything. It costs you nothing, and it will tell you more about your tenant than any dashboard. For more Microsoft 365 governance and certification content, subscribe to the Vlad Talks Tech newsletter at vladtalkstech.com. Want to send feedback straight to the product team? Connect with Dave Minasyan on LinkedIn.

Prefer video? Watch the full walkthrough with Dave Minasyan on YouTube. You can also follow the SharePoint Advanced Management 2026 playlist or watch the complete interview in one sitting.

SharePoint Catalog Management: Group Sites by Department

Vlad Catrinescu — Wed, 19 Aug 2026 05:01:37 GMT

SharePoint catalog management groups every site in your tenant into categories like department, region, or cost center, so admin reports and AI-driven insights come back organized the way your business actually works. Without it, the SharePoint Admin Agent sees a flat list of thousands of sites with no idea which ones matter to you. This guide covers the built-in categories you get for free, the three ways to build your own, and the refresh schedules that trip people up.

Key takeaways

Catalog management lives in the SharePoint admin center under Reports > Catalog management, and is part of SharePoint Advanced Management.
Five built-in categories are populated automatically with no configuration and refresh every hour.
You can add your own categories three ways: a CSV site list, a custom site property, or a Microsoft Entra ID extension attribute.
Each category can hold up to 20 groups, and a single site can belong to multiple categories at once.
Custom property and Entra ID categories scan up to 20,000 sites, refresh within 24 hours, then update every two weeks.
The structure you build directly determines how specific the SharePoint Admin Agent’s answers can be.

What SharePoint catalog management actually does

Most tenants are unstructured by default. Sites get created over years by different teams for different reasons, and nothing in SharePoint records which business unit owns what. That is fine until you try to govern at scale, or until you point an AI agent at the environment and ask it a question that requires business context.

This is the problem catalog management solves. It reads metadata that already exists in your Microsoft 365 tenant and uses it to sort sites into categories (high-level classifications like department or region) and groups (the values inside a category, like Marketing, Sales, or Finance). Nothing is created or invented. Catalog management surfaces structure that is already implied by your data.

The distinction that matters: categories are the question, groups are the answers. “Department” is a category. “Finance” is a group inside it.

Right now catalog management covers sites only. That includes any site that appears in your active sites list, so group-connected sites, team sites, channel sites, and communication sites are all in scope.

The built-in categories you get with no setup

Five categories are populated automatically and require no configuration at all:

Locale — the region where content is hosted
Department — the organizational unit associated with the site
User type — guest or non-guest
Preferred data location — for multi-geo tenants
Information barriers segment — for organizations using information barriers policies

These refresh every hour, which makes them the fastest-moving data in the entire feature.

The Department category is the one worth understanding, because it works indirectly. Catalog management looks at every site, identifies the owners, checks whether those owners have a department attribute set in Microsoft Entra ID, then buckets each site under its owner’s department. There is real logic behind it too: when a site has multiple owners, the system weighs the majority of active owners rather than picking the first one it finds.

That indirection has a consequence worth planning for. Your site categorization is only as good as your Entra ID user data. If half your site owners have no department attribute set, half your sites land nowhere useful.

What the “Other” bucket tells you about your tenant

Sites whose owners have no department set in Microsoft Entra ID get collected into a group called Other. Every group in catalog management has a download button, so you can export that list and see exactly which sites are affected.

Treat the size of that Other bucket as a health metric. A large Other group is not a catalog management problem, it is an identity data problem showing up somewhere visible for the first time. The fix is upstream, in Entra ID, and every site you fix there improves both your governance reporting and the quality of answers you get from AI tools that depend on this structure.

Here is the quickest health check you can run, and it takes about ten seconds. Compare the site count in Locale against the count in Department. Locale should cover essentially every site, because every SharePoint site has a region. Department only covers sites whose owners have a department attribute. So the gap between those two numbers is, near enough, your uncategorized estate.

In the Microsoft demo tenant used in the video, Locale showed roughly 141,000 sites while Department came in about 7,000 lower. Those are invented figures in a demo environment, not a benchmark to measure yourself against, but the shape of the problem is real, and it is the first thing to look at in your own tenant. A gap that size means several thousand sites whose owners cannot be resolved to a department, and every one of them lands in Other.

Three ways to build your own categories

The built-in categories are a starting point. Larger organizations almost always want structure that reflects their own operating model, and the ability to add your own categories is rolling out now.

There are three methods, each with a different label in the admin center so you can tell at a glance where a category came from.

Upload a CSV site list

Best when you already know exactly which sites belong together and no existing metadata captures it. The classic example is executive content: a set of sites that need to be governed differently from everything else, with no property that identifies them.

Download the CSV template, create one file per group, and upload. Categories appear almost immediately, and this method carries the UPLOADED label.

One important caveat: an uploaded category is a snapshot, not a live query. New sites that should belong to the group will not appear on their own. You have to update the list manually. If you go this route for something that changes often, plan the maintenance.

Use a custom site property

Best when your organization already writes classification data into the SharePoint site property bag, typically as part of a site provisioning process.

Point catalog management at a property name such as CostCenter, and it opens each site, reads that property’s value, and creates a group for every distinct value it finds. Five cost center values produce five groups, populated automatically. You can specify up to 20 properties in a single category, and despite the name, this works with any property in the property bag, not just custom ones.

This is where the tool becomes genuinely powerful for organizations with a custom provisioning process. Write the classification at creation time and every new site is categorized from day one, rather than being tagged reactively months later.

Scope is capped at 20,000 sites, either the most active sites or a list you supply. This is a cost boundary rather than a technical one, since scanning sites and reading their contents is expensive, and Microsoft has signalled it intends to raise it.

Use a Microsoft Entra ID extension attribute

Best when your business classification lives in identity rather than in SharePoint. If your organization populates extensionAttribute1 through extensionAttribute15 with things like business unit, operating model, or compliance boundary, you can turn any of those into a catalog category.

Like the built-in Department category, this groups sites by their owners’ attribute values, and groupings update as attributes or site ownership change.

How often each category type refreshes

SharePoint catalog management refreshes on a different schedule for each category type, and this catches people out more than any other detail in the feature.

Category type	First data	Ongoing refresh
Built-in	Immediate	Every hour
Uploaded CSV	Immediately after upload	Manual only
Custom properties	Within 24 hours	Every two weeks
Entra ID extension attributes	Within 24 hours	Every two weeks

The practical consequence: if you set up a custom property category and see nothing an hour later, nothing is broken. Wait a day. And if you fix a batch of Entra ID attributes on Monday expecting the catalog to reflect it, you may be waiting up to two weeks.

What the SharePoint Admin Agent does with the structure

This is the payoff, and it is the reason catalog management exists rather than being a nice-to-have reporting feature.

Once sites are categorized, the SharePoint Admin Agent can reason across those categories instead of across an undifferentiated pile of sites. Rather than reporting total tenant storage, it can break storage down by department. It can combine two categories at once, comparing a region against a department to find where a specific business unit’s content actually sits. It can surface a growth rate, project how long you have before you run out of storage, and flag anomalies, all scoped to the structure you defined.

Everything the agent produces here is technically available today. You could export the reports, write the scripts, and build the Power BI workbook yourself. The difference is that the agent does it in seconds from a typed question, and it does not require you to know how to build any of that.

A point Dave Minasyan, Principal Product Manager at Microsoft, returned to twice during our conversation is worth stating plainly, because it explains why the setup work falls to you:

We do not train the agents that we have or the LLMs that we have with your data.

The agent has no prior knowledge of how your organization is structured and never will. It waits for the data to be available and then answers the question you ask. That is precisely why catalog management asks you to define the structure yourself, and why the quality of your answers depends on the quality of your setup.

What this means for you

If you already have SharePoint Advanced Management, whether through a Microsoft 365 Copilot license or the standalone add-on, the built-in categories are live in your tenant right now. Go and look at them before you plan anything. The gap between your Locale and Department site counts will tell you more about your governance readiness in thirty seconds than a week of report exports.

Your first real task is probably not in SharePoint at all. If a large share of your sites land in the Other bucket, fix the department attributes in Microsoft Entra ID first. That single upstream change improves the built-in Department category, any extension attribute categories you build later, and every answer the SharePoint Admin Agent gives you.

For custom structure, the sequencing matters. Organizations with a custom provisioning process should add classification properties to that process now, so new sites are categorized from creation. Retrofitting via PowerShell across an existing estate works, but expect to let it run overnight on a large tenant. As a Microsoft MVP who has spent a lot of time on SharePoint governance tooling, my honest read is that the property bag approach is the one worth investing in, because it is the only method that stays accurate without ongoing manual effort.

On timing, the setup itself is not the hard part. Microsoft reports that mid-size to large customers it has worked with generally complete their catalog setup within a day or two. Deciding what your categories should be is the part that takes longer, and it is worth doing properly, because most organizations set this up once and rarely change it.

Where to go next

Ready to get your tenant organized before you scale governance further? Start by opening Reports > Catalog management in the SharePoint admin center and comparing your Locale and Department site counts. If you want the wider context on what shipped this year, read my breakdown of what’s new in SharePoint Advanced Management for 2026, and for the governance features that sit alongside this one, see my overview of content governance in SharePoint Premium. If storage is what is driving your interest here, my guide to managing SharePoint Online storage covers the fundamentals the agent is reporting on.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

AB-620 Exam: What to Expect, Difficulty, and Study Tips

Vlad Catrinescu — Wed, 19 Aug 2026 04:59:33 GMT

The AB-620 exam is the path to the brand-new Microsoft Certified: AI Agent Builder Associate certification, and after taking the beta a few hours ago, I want to share my honest first-look review. If you are deciding whether to sit for this exam, what to study, or whether you are even the right audience for it, this post covers everything I can share without breaking NDA.

Key takeaways

Passing the AB-620 exam earns you the Microsoft Certified: AI Agent Builder Associate certification.
Despite being tagged as an app maker exam on Microsoft Learn, the AB-620 is really built for developers and consultants integrating Copilot Studio with enterprise systems.
Microsoft scrapped the original AB-610 Copilot Studio Agent Maker exam and consolidated everything into the AB-620.
Expect heavy coverage of Azure AI Search, Microsoft Foundry, Microsoft Fabric, the agent-to-agent protocol, and Power Platform pipelines for ALM.
Testing agents and application lifecycle management makes up 20 to 25 percent of the exam, which is enough to make or break a pass.
If you are a Power Platform app maker, the Copilot Studio Applied Skills are likely a better fit than this exam.

What is the AB-620 exam?

The AB-620 is a Microsoft associate-level certification exam currently in beta. Pass it and you earn the Microsoft Certified: AI Agent Builder Associate credential. The official exam name is Designing and Building Integrated AI Solutions in Copilot Studio.

The exam tagline tells you most of what you need to know: Develop and integrate advanced, scalable AI agents using Microsoft Copilot Studio, Power Platform, and enterprise technologies to deliver robust solutions for organizations. In plain language, the AB-620 exam is about putting agents into production, not about the basics of agent building.

Why the AB-620 is really a Copilot Studio developer exam

Here is the most important thing to understand before you register: even though the exam is tagged as an app maker exam on Microsoft Learn, in my opinion that tagging is misleading. The AB-620 is built for developers and consultants who spend almost every workday building agentic solutions that integrate Copilot Studio with Microsoft Foundry, Azure AI Search, Microsoft Fabric, and more.

If you are a citizen developer who occasionally builds a topic in Copilot Studio, this exam will feel out of reach. If you live in Copilot Studio and routinely wire it up to enterprise services, you are exactly the audience Microsoft built the AB-620 for.

Having spent the last decade helping IT pros prepare for Microsoft certifications, I have seen plenty of exam mismatches between the listed persona and the actual content. The AB-620 is one of the more notable examples I have come across recently.

What happened to the AB-610?

A few months ago, Microsoft announced two Copilot Studio certifications: the AB-610 Copilot Studio Agent Maker and the AB-620 Copilot Studio Agent Developer. That two-track approach made sense. The Agent Maker exam would have covered the low-code persona, and the Agent Developer exam would have covered the integration-heavy persona.

Microsoft has since scrapped the AB-610 and consolidated everything into the AB-620. Instead of keeping the original Copilot Studio Agent Developer name, which would have been honest signaling, Microsoft renamed the exam to AI Agent Builder Associate. That broader name suggests both makers and developers belong here, but the content still skews heavily toward the developer side.

For the full backstory on these two exams, see my earlier post on the original AB-610 vs AB-620 Copilot Studio certifications.

What the AB-620 exam actually tests

The meat of the AB-620 exam is about production-grade agents and the advanced scenarios an enterprise will ask about before it ships an agent to production. Do not expect questions about turning generative AI on, what a topic is, or who should be authoring agents. That foundational content is not what this exam is measuring.

What you will see is heavy coverage of how to connect a Copilot Studio agent to enterprise services. Specifically, expect to be tested on:

Connecting a Copilot Studio agent to Azure AI Search
Connecting a Copilot Studio agent to a Microsoft Fabric data agent
Connecting a Copilot Studio agent to a Microsoft Foundry agent
Connecting to partner agents outside your tenant using the agent-to-agent protocol
Designing multi-agent solutions that span those systems

Real production agents today are rarely built entirely inside Copilot Studio. The AB-620 reflects that reality by testing your ability to design solutions that span multiple Microsoft AI services.

Testing agents and ALM with Power Platform pipelines

A second major area of the AB-620 exam covers testing agents and application lifecycle management. This bucket is marked at 20 to 25 percent of the exam, which sounds modest on paper but is more than enough to be the difference between pass and fail.

You need to know all the ways to test Copilot Studio agents and how to implement application lifecycle management for agents using Power Platform pipelines. The exam expects you to be able to take an agent from a development environment, through any required validation, and all the way to production while following a proper ALM process.

The takeaway is that the AB-620 does not assume you are only a builder. It assumes you own the full lifecycle of an agent, from build to release.

How to study for the AB-620 exam

The single best piece of advice I can give is to do every scenario in the exam objectives at least once before sitting down. Go to Microsoft Learn, pull up the AB-620 study guide, and work through the tasks hands on:

Connect a Copilot Studio agent to Azure AI Search.
Connect a Copilot Studio agent to a Microsoft Foundry agent.
Connect a Copilot Studio agent to another Copilot Studio agent.
Experiment with the agent-to-agent protocol so you know what it is and why it exists.
Build a deployment flow for an agent using Power Platform pipelines.

Why does hands-on practice matter so much? Because every associate-level Microsoft exam, including this one, leans heavily on order-list questions. You will be asked, “you want to do this, put the following steps in the correct order.” If you have not configured the scenario recently, those questions are punishing. If you have walked through it once, they become almost free.

The other point worth flagging is the question weighting. Microsoft did honor the study guide in the sense that nothing showed up in my beta that was not on the published exam objectives. However, the percentage of questions from each bucket felt off compared to the weights listed on the study guide. I cannot share which buckets were over-represented or under-represented due to NDA, but my recommendation is the same as it always is for a beta: study every skill area equally and do not lean on the weights as a planning tool.

Exam format, questions, and Microsoft Learn access

A few practical notes about the exam itself:

The number of questions is always between 40 and 60. I cannot share the exact count for the AB-620.
You have access to Microsoft Learn during the exam, just like every other associate-level exam. I did not end up using it, but it is there if you need to verify something.
Expect associate-level question types: scenario-based questions, order lists, and multi-step problems. This is not the difficulty level of a fundamentals exam.
Labs may show up. Microsoft does not publish whether a given exam includes hands-on labs, and I cannot share what was on my exam, but be prepared for the possibility.

AB-620 vs Copilot Studio Applied Skills

If you are a Power Platform app maker who does not spend all day in Copilot Studio, the AB-620 is probably too advanced for where you are right now. The better path is the Copilot Studio Applied Skills. There are two of them available, and they validate hands-on Copilot Studio skills without the integration-heavy enterprise scope of the AB-620.

If you want a deeper look at the lab-based credential for Copilot Studio, see my APL-7008 study guide for creating agents in Microsoft Copilot Studio.

The AB-620 is still a great goal if your job is to become a full-time Copilot Studio agent builder, or if you are already a developer integrating AI services across the Microsoft stack. For everyone else, the Applied Skills path will give you a recognized credential without the steep developer-focused prep.

What this means for you

The AB-620 is a high-value certification for a narrow audience: developers, consultants, and architects building production-grade agents that span Copilot Studio, Azure AI Search, Microsoft Foundry, Microsoft Fabric, and Power Platform. If that describes your day-to-day work, this exam validates the skills you are already using and is well worth the prep time.

If you are a citizen developer, business user, or IT pro who builds simple Copilot Studio agents on the side, this exam is not the right next step. Start with the Copilot Studio Applied Skills instead. They give you a recognized credential without asking you to master enterprise integration patterns you may never use.

Before you register, pull up the AB-620 exam objectives on Microsoft Learn and do an honest gap analysis. If you can do each task on the list without looking it up, you are ready. If half the objectives are unfamiliar, build hands-on time with the missing scenarios before scheduling the exam. Beta exams take longer to score, so plan accordingly if you are aiming for a specific certification deadline.

Prefer video? Watch the full walkthrough on my YouTube channel.

Ready to build your Copilot Studio skills the right way? I have over 100 courses on Pluralsight covering Microsoft 365, Power Platform, and Copilot, including hands-on agent building. Browse the full course catalog on Pluralsight to find your next step.

SharePoint Content Assessment: Where to Start

Vlad Catrinescu — Tue, 18 Aug 2026 13:32:30 GMT

If you administer SharePoint and you have been asked where to begin with content governance, the SharePoint Content Assessment is the answer. It lives in the Advanced Management section of the SharePoint admin center; it runs from a single button, and it scans your entire tenant for the patterns that quietly undermine both search and AI. Dave Minasyan, Principal Product Manager at Microsoft, walked me through how it works and what it surfaces.

Key takeaways

The assessment runs from one button in the Advanced Management area of the SharePoint admin center and automatically executes the primary reports Microsoft recommends.
A full run takes anywhere from 24 hours to five days, depending on the size of your tenant.
Two assessment areas are live today: site lifecycle and oversharing, with a storage assessment in development.
Much of the data it returns is not available through PowerShell or the Microsoft Graph APIs, which is why the results surprise teams who believed they were already on top of governance.
The SharePoint Admin Agent depends on this data. Without a completed assessment, the agent has nothing meaningful to reason over.

What the SharePoint Content Assessment Actually Does

Microsoft built the assessment to answer the single most common question admins ask when they start taking content governance seriously: where do I start?

The problem is rarely a lack of tools. Most organizations have a plethora of capabilities scattered across Microsoft 365, third-party vendors, and scripts somebody wrote years ago. What they lack is a systematic way to see the current state of their content estate and decide what to fix first.

The assessment addresses that by running a set of default reports across your tenant, identifying patterns in the results, and surfacing them as prioritized findings. You can then drill into any individual report, customize it, and re-run it against a narrower scope.

One important scoping note: this is content governance, not content security. Securing content is a separate discipline that lives largely in Microsoft Purview, though many Purview capabilities are grounded in the same SharePoint Advanced Management data.

Where to Start: One Button in the SharePoint Admin Center

The workflow is deliberately simple. Open the Advanced Management tab in your SharePoint admin center and click Start Assessment. Microsoft then runs all the primary reports it recommends as a starting point, in their default configuration, and reports the patterns it finds.

The experience is already available across most geographies.

If you do nothing else, running the assessment in its default state is usually enough to move you into a reasonably good position on content governance, and it produces the data your admin agent needs in order to be useful.

Why the First Results Look Worse Than Expected

The first run tends to be uncomfortable, and there is a good reason for that.

Plenty of organizations have in-house processes they believe put them in good shape. They run the assessment expecting a quick confirmation, and instead they find a long list of things they had missed entirely.

This is not a reflection on those teams. A large amount of the data the assessment returns is genuinely new, and was not previously exposed through PowerShell or the APIs. Microsoft built these reports specifically to unblock customers moving toward AI, which means unless you were deducing all of this yourself from indirect signals, you almost certainly did not have it.

So a confronting first run is the expected outcome, not a sign that something went wrong.

What the Assessment Checks Today

Go into your tenant right now, and you will see two assessment cards:

Site lifecycle, which surfaces inactive sites and other lifecycle signals
Oversharing, which surfaces content permissioned far more broadly than anyone intended

A third card covering storage analysis is in active development. Storage is one of the largest drivers of customer support contacts, so Microsoft is working to simplify how organizations understand and optimize what they are consuming.

This area is expected to change substantially over time. Microsoft has collected a significant amount of feedback asking for additional assessment types and is prioritizing which to build next.

From Reports to Remediation

The assessment does more than show you where the problem areas are. Each finding can be expanded into a downloadable report listing exactly which sites are affected, along with recommended remediation steps.

From there, you can follow the links Microsoft provides directly into policy creation. If inactive sites are the issue, you can click through to the inactive sites policy and create a new policy scoped precisely to your requirements. These policies also carry actions, so you can build follow-through automation rather than just producing another report nobody acts on.

That distinction matters. A finding you cannot act on is just an alarming number. A finding wired to a scoped policy with an action attached is actual governance.

How the SharePoint Admin Agent Uses This Data

Running the assessment serves two purposes. The first is seeing your problem areas. The second, and the one that gets overlooked, is feeding the SharePoint Admin Agent.

Without assessment data, the agent has nothing to reason over and cannot give you useful answers. Once the reports have run, the agent reads what is available and starts extracting information from it. You can then ask questions in natural language about your own tenant.

During Microsoft’s focus group testing, one participant typed in a question about which sites had last been accessed by external users, essentially at random, and got back a genuinely good answer. For each question, the agent returns an analysis of the relevant data, key insights including any anomalies it spotted, and a recommended action.

The practical effect is that you no longer need to know which report to run or which setting to change. You need to know what problem you want to solve.

The agent is launching with roughly 15 to 20 supported skills, and Microsoft is targeting somewhere in the region of 150 actions over time.

One expectation to set: a full assessment run takes between 24 hours and five days depending on how large your tenant is. This is not a report you click and read over coffee. Start it, let it finish, then come back and start asking questions.

Why This Matters Even Without Microsoft 365 Copilot

Microsoft built and marketed this capability around AI readiness, and that framing is doing it a disservice for a lot of organizations.

Even if you have no plan to deploy Microsoft 365 Copilot broadly in the next year, running the assessment will improve your tenant. Inactive sites cluttering results, content shared far more widely than intended, storage nobody is tracking, these are search problems and security problems long before they are AI problems. Fixing them pays off regardless of what you do with Copilot.

Having worked with SharePoint environments for over a decade, I would put it this way: content governance was always important, and AI simply made it visible. AI is an amplifier. Whatever state your content is in, good or bad, deploying AI on top of it will amplify that state.

Dave made the same point from the Microsoft side, and it is worth repeating: content governance is not optional. It is how you maintain the information that is most valuable to your organization, and it is frequently the differentiating factor when you are competing.

What This Means for You

If you administer a SharePoint tenant, the immediate action is straightforward. Open the Advanced Management area, click Start Assessment, and let it run. It costs you one click and a few days of waiting, and it will tell you more about your content estate than most internal audits will.

When the results come back, resist the urge to treat the number as a verdict. Work through the downloadable reports, identify which findings represent genuine risk in your environment, and use the policy links to create scoped policies with actions attached. Prioritize oversharing findings first, because those carry security implications that inactive sites do not.

If you are planning any AI deployment, whether that is Microsoft 365 Copilot or something else entirely, treat the assessment as a prerequisite rather than a nice-to-have. Deploying AI over ungoverned content does not create new problems so much as it makes existing ones impossible to ignore. And if you want the SharePoint Admin Agent to be useful, the assessment is not optional at all, because the agent is only as good as the data underneath it.

Finally, plan to re-run this. The assessment area is going to develop significantly, and the storage card in particular is worth watching for.

Ready to get your tenant in shape before your next AI rollout? The Content Assessment is one piece of a much larger set of capabilities that shipped in this release. Start with my overview of what’s new in SharePoint Advanced Management for 2026, then dig into content governance in SharePoint Premium for the wider context. If oversharing is your most pressing concern, my conversation on preventing Copilot oversharing covers that specific problem in depth.

Prefer video? Watch the full walkthrough with Dave Minasyan on my YouTube channel.

Vlad Talks Tech

SharePoint Skills FAQ: Your Webinar Questions Answered

Skills vs Saved Prompts and Other Tools

Why Is a Skill Different From a Saved Prompt?

When Should I Use a Skill Instead of a Power Automate Flow, a Copilot Studio Agent, or a SharePoint Agent?

Running Skills

Can Skills Run on a Schedule, When a File Is Added, or From Power Automate?

Is There a Limit to How Many Documents a Skill Can Classify, and Can It Handle 10,000 Files?

Can a Skill Create Site Pages From a Template and Add Quick Links Web Parts?

Sharing and Protecting Skills

Why Can’t I Share a Skill I Created in a Shared OneDrive Folder?

How Do I Protect the Skill Files in the Agent Assets Library?

Governance and Lifecycle Management

Can I Maintain SKILL.md Files With Azure Pipelines in Azure DevOps?

Until Enterprise Skills Arrive, Is PnP PowerShell the Way to Govern Skills?

SharePoint Agents vs Microsoft 365 Copilot Agents

What’s the Difference Between the Default SharePoint Agent and a Custom Agent, and Can You Share Them?

Is a SharePoint Agent the Same as an Agent Created in Microsoft 365 Copilot?

What This Means for You

SharePoint Advanced Management Roadmap: Shipped and Coming

What SharePoint Advanced Management can do today

The SharePoint Admin Agent

Where to start: the content management assessment

Catalog management: structure your sites

Oversharing reports and the new admin role

Agent access insights

Resilience: settings and backup

Multi-Geo, in preview

What’s still coming on the SharePoint Advanced Management roadmap

Two things that shipped since this was recorded

Licensing and availability: what you actually need

What this means for you

SharePoint Content Resilience: Backup, Archive & Multi-Geo

What SharePoint Content Resilience Means

The SharePoint Admin Agent’s New Resilience Skills

Baseline Security Mode, Checked for You

Microsoft 365 Backup: Point-in-Time Restore

Microsoft 365 Archive: Cold Storage That Stays in Place

Version History: The Everyday Safety Net

Multi-Geo: Keeping Data in the Right Country

Licensing and Availability, Product by Product

Bring Resilience Into Your Governance Plan

SharePoint Site Access Reviews: A Practical Guide

What Are SharePoint Site Access Reviews?

Why Delegate Reviews to Site Owners?

How a Site Access Review Works

The Site Owner Experience and the Governance Hub

Site Access Review Limits You Should Know

How Site Access Reviews Fit with RCD and RAC

Automating Reviews with the SharePoint Admin Agent

Licensing and Availability

Where to Go Next

SharePoint Agent Governance: Monitor and Control Access

What SharePoint agent governance actually controls

Two reports, one menu, very different data

What the agent access insights report shows you

The limits nobody mentions on camera

Turning on data collection

Which agents actually show up

Restricted Content Discovery is the main lever, and it has edges

Licensing and availability limits

What is not there yet

Where to go next

SharePoint Oversharing Reports and the New SAM Admin Role

The Five Types of SharePoint Oversharing

Start With the Permission State Report

Where Microsoft Purview Fits In

SharePoint Oversharing Reports Now Reach the File Level

What You Actually Get in the Export

The New SharePoint Advanced Management Administrator Role

Why Global Admins Have to Opt In

What This Means for You

SharePoint Site Lifecycle Management: A Practical Guide

What SharePoint Site Lifecycle Management Actually Does

The Three Policy Types and When to Use Each

Inactive Site Policies

Site Ownership Policies

Site Attestation Policies

How SharePoint Decides a Site Is Inactive

Simulation Mode: See the Impact Before You Commit