ShareScout

Microsoft 365 Oversharing & Permissions Report
Contoso Nordics AB · 2026-09-17 22:34 UTC
Sites reachable by every employee
17 of 35
40 Anyone links (26 never expire) · 27 guests with site access · read-only audit · nothing left your tenant
2 site(s) hit the per-site item cap; their counts are lower bounds.
47
Sites scanned (incl. OneDrive)
18
Stale guests (> 90 d)
7
Ownership issues
11
Sites without a sensitivity label

Copilot exposure score — top sites

Score 0–100 per site: Everyone/EEEU membership (+40), Anyone links (+30), guests (+15), unique-permission items (up to +15). "Weighted" multiplies by log10(items) so a wide-open 50,000-item site outranks a wide-open empty one. Bars show the score; the list is ordered by weighted score. Highest: Data Platform (score 70, weighted 280).

Data Platform
70
Payroll
70
Legal
85
Facilities
85
HR
70
Marketing
62
M&A Project Falcon
71
Board
70
Finance
55
Sales EMEA
55
SiteKindScoreWeightedEEEUAnyone linksGuestsUnique itemsItemsLabel
Data PlatformTeam site (M365 group)70280True20010841(none)
PayrollTeam site (M365 group)70273True40268420(none)
LegalTeam site (M365 group)85264True3201396Confidential
FacilitiesTeam site (M365 group)85264True5901199(none)
HRTeam site (M365 group)70259True3045021(none)
MarketingTeam site (M365 group)62248True0273510180Highly Confidential
M&A Project FalconTeam site (M365 group)71248True601192877(none)
BoardTeam site (M365 group)70245True60863120Highly Confidential
FinanceTeam site (M365 group)55236True03021170Public
Sales EMEATeam site (M365 group)55231True00243514442(none)
ProcurementTeam site (M365 group)55209True0906706General
Nordics LeadershipTeam site (M365 group)55204True0204865General
All HandsTeam site (M365 group)40192True00061000General
Copilot PilotTeam site (M365 group)55187True01372761(none)
Archive 2019Site85187True238169(none)
Legacy ProjectsSite45171False2306560Confidential
IntranetCommunication site40156True0018778Highly Confidential
PartnersTeam site (M365 group)40148True0005061(none)
NewsCommunication site40144True0024001(none)
Maria DahlOneDrive45140False1111316(none)

1. Anyone links (40)

Anonymous links: anyone holding the URL can open the content, no sign-in. Links with no expiry stay valid until someone removes them.

SitePathTypeFolderCreatedExpires
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Exports/ArchiveAnyone can viewTrue2024-07-16never
Facilities/sites/Facilities/Shared Documents/Exports/2026Anyone can viewTrue2024-08-27never
Board/sites/Board/Shared Documents/Q3/DraftsAnyone can viewTrue2024-11-04never
Archive 2019/sites/Archive2019/Shared Documents/Offers/roadmap-4.docxAnyone can viewFalse2024-11-12never
HR/sites/HR/Shared Documents/Offers/DraftsAnyone can viewTrue2024-12-04never
Data Platform/sites/DataPlatform/Shared Documents/Board packs/NDA-40.docxAnyone can viewFalse2025-01-11never
Board/sites/Board/Shared Documents/Board packs/customers-14.pdfAnyone can viewFalse2025-04-10never
Payroll/sites/Payroll/Shared Documents/Board packs/salaries-89.pdfAnyone can editFalse2025-04-14never
Research/sites/Research/Shared Documents/Board packs/roadmap-63.pptxAnyone can viewFalse2025-04-15never
Board/sites/Board/Shared Documents/Pricing/salaries-16.pdfAnyone can viewFalse2025-05-17never
Legal/sites/Legal/Shared Documents/Q3/ArchiveAnyone can viewTrue2025-08-21never
Payroll/sites/Payroll/Shared Documents/Contracts/NDA-39.pdfAnyone can viewFalse2025-08-27never
Payroll/sites/Payroll/Shared Documents/Exports/2026Anyone can viewTrue2025-09-06never
Maria Dahl/personal/maria_dahl_contosonordics_com/Documents/Contracts/pricing-25.pdfAnyone can editFalse2025-09-10never
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Exports/customers-93.pptxAnyone can viewFalse2025-09-17never
Board/sites/Board/Shared Documents/Customer data/salaries-32.xlsxAnyone can viewFalse2025-12-02never
Research/sites/Research/Shared Documents/Board packs/NDA-27.pdfAnyone can editFalse2025-12-02never
Legal/sites/Legal/Shared Documents/Q3/forecast-72.xlsxAnyone can viewFalse2026-01-02never
Payroll/sites/Payroll/Shared Documents/Board packs/DraftsAnyone can editTrue2026-03-15never
Research/sites/Research/Shared Documents/Board packs/forecast-10.pptxAnyone can viewFalse2026-04-01never
Research/sites/Research/Shared Documents/Customer data/pricing-93.pptxAnyone can viewFalse2026-04-01never
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Pricing/forecast-72.xlsxAnyone can editFalse2026-04-01never
HR/sites/HR/Shared Documents/Offers/forecast-79.pptxAnyone can viewFalse2026-06-15never
Board/sites/Board/Shared Documents/Contracts/roadmap-68.pdfAnyone can viewFalse2026-07-14never
Board/sites/Board/Shared Documents/Q3/roadmap-29.docxAnyone can viewFalse2026-07-30never
Kari Sand/personal/kari_sand_contosonordics_com/Documents/Offers/roadmap-14.pptxAnyone can editFalse2026-09-12never
Legal/sites/Legal/Shared Documents/Offers/customers-66.pptxAnyone can viewFalse2024-06-232026-08-24
HR/sites/HR/Shared Documents/Exports/pricing-81.pptxAnyone can viewFalse2024-09-072026-08-30
Facilities/sites/Facilities/Shared Documents/Offers/roadmap-89.pptxAnyone can viewFalse2024-11-032026-10-03
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Contracts/roadmap-14.pptxAnyone can viewFalse2024-12-012026-10-07
Legacy Projects/sites/LegacyProjects/Shared Documents/Contracts/forecast-96.pptxAnyone can editFalse2025-02-132026-09-26
Legacy Projects/sites/LegacyProjects/Shared Documents/Customer data/salaries-66.docxAnyone can viewFalse2025-02-202026-09-03
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Contracts/NDA-67.pptxAnyone can viewFalse2025-03-102026-09-28
Research/sites/Research/Shared Documents/Contracts/ArchiveAnyone can editTrue2025-04-242026-10-12
Data Platform/sites/DataPlatform/Shared Documents/Offers/2026Anyone can viewTrue2025-08-102026-09-13
Archive 2019/sites/Archive2019/Shared Documents/Exports/customers-55.docxAnyone can viewFalse2025-09-112026-11-10
Facilities/sites/Facilities/Shared Documents/Exports/forecast-18.xlsxAnyone can editFalse2025-11-172026-10-15
Facilities/sites/Facilities/Shared Documents/Q3/customers-88.xlsxAnyone can viewFalse2026-02-252026-10-12
M&A Project Falcon/sites/MAProjectFalcon/Shared Documents/Contracts/customers-37.xlsxAnyone can editFalse2026-02-252026-10-17
Facilities/sites/Facilities/Shared Documents/Customer data/pricing-14.docxAnyone can editFalse2026-08-222026-10-05

2. Everyone / Everyone except external users (17 sites, 27 items)

Sites where a whole-organisation claim sits in Owners, Members or Visitors — every employee, and every Copilot prompt from every employee, can reach this content. Public M365 groups land here too.

SiteKindViaItemsLabel
All HandsTeam site (M365 group)Everyone except external users via All Hands Members61000General
FinanceTeam site (M365 group)Everyone except external users via Finance Members21170Public
Data PlatformTeam site (M365 group)Everyone except external users via Data Platform Visitors10841
MarketingTeam site (M365 group)Everyone except external users via Marketing Visitors10180Highly Confidential
IntranetCommunication siteEveryone except external users via Intranet Visitors8778Highly Confidential
PayrollTeam site (M365 group)Everyone (direct)8420
PartnersTeam site (M365 group)Everyone except external users via Partners Visitors5061
HRTeam site (M365 group)Everyone except external users via HR Visitors5021
Nordics LeadershipTeam site (M365 group)Everyone except external users via Nordics Leadership Visitors4865General
NewsCommunication siteEveryone except external users via News Visitors4001
BoardTeam site (M365 group)Everyone except external users via Board Members3120Highly Confidential
M&A Project FalconTeam site (M365 group)Everyone except external users via M&A Project Falcon Members2877
SecurityTeam site (M365 group)Everyone except external users via Security Visitors2813Public
BenefitsCommunication siteEveryone except external users via Benefits Visitors2017Highly Confidential
LegalTeam site (M365 group)Everyone except external users via Legal Visitors1396Confidential
FacilitiesTeam site (M365 group)Everyone except external users via Facilities Members1199
Events 2026Team site (M365 group)Everyone except external users via Events 2026 Members102Public
SiteItem pathPrincipal
Sales EMEA/sites/SalesEMEA/Shared Documents/Handbook-0.xlsxEveryone except external users
Sales EMEA/sites/SalesEMEA/Shared Documents/Payroll export-1.xlsxEveryone except external users
Finance/sites/Finance/Shared Documents/Org chart-0.docxEveryone except external users
Finance/sites/Finance/Shared Documents/Payroll export-1.xlsxEveryone except external users
Marketing/sites/Marketing/Shared Documents/Payroll export-0.docxEveryone except external users
Marketing/sites/Marketing/Shared Documents/Templates-1.xlsxEveryone except external users
Procurement/sites/Procurement/Shared Documents/Org chart-0.docxEveryone except external users
Copilot Pilot/sites/CopilotPilot/Shared Documents/Handbook-0.xlsxEveryone except external users
Copilot Pilot/sites/CopilotPilot/Shared Documents/Org chart-1.docxEveryone except external users
Nordics Leadership/sites/NordicsLeadership/Shared Documents/Org chart-0.xlsxEveryone except external users
Nordics Leadership/sites/NordicsLeadership/Shared Documents/Org chart-1.xlsxEveryone except external users
Nordics Leadership/sites/NordicsLeadership/Shared Documents/Templates-2.docxEveryone except external users
Events 2026/sites/Events2026/Shared Documents/Payroll export-0.xlsxEveryone except external users
Events 2026/sites/Events2026/Shared Documents/Templates-1.docxEveryone except external users
Events 2026/sites/Events2026/Shared Documents/Org chart-2.docxEveryone except external users
Data Platform/sites/DataPlatform/Shared Documents/Payroll export-0.docxEveryone except external users
Security/sites/Security/Shared Documents/Org chart-0.xlsxEveryone except external users
Security/sites/Security/Shared Documents/Templates-1.docxEveryone except external users
Security/sites/Security/Shared Documents/Templates-2.xlsxEveryone except external users
Security/sites/Security/Shared Documents/Org chart-3.docxEveryone except external users
Intranet/sites/Intranet/Shared Documents/Handbook-0.xlsxEveryone except external users
Intranet/sites/Intranet/Shared Documents/Templates-1.xlsxEveryone except external users
News/sites/News/Shared Documents/Org chart-0.docxEveryone except external users
News/sites/News/Shared Documents/Payroll export-1.docxEveryone except external users
Archive 2019/sites/Archive2019/Shared Documents/Org chart-0.docxEveryone except external users
Archive 2019/sites/Archive2019/Shared Documents/Org chart-1.docxEveryone except external users
Archive 2019/sites/Archive2019/Shared Documents/Templates-2.xlsxEveryone except external users

3. Guest access (27 guests, 56 grants)

External accounts with site access, and how they got it. Stale = no sign-in in 90 days.

SiteGuestViaLast sign-inStaleEnabled
Nordics Leadershipaxel.dahl29_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comNordics Leadership MembersneveryesTrue
Archive 2019emma.moe19_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Recruitingaxel.berg25_gmail_com#EXT#@contosonordics.onmicrosoft.comRecruiting Members2026-05-09yesTrue
QAeva.holm15_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comQA Visitors2025-07-02yesTrue
Nordics Leadershiplars.lund14_adatum_dk#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Copilot Pilotola.jensen16_adatum_dk#EXT#@contosonordics.onmicrosoft.comCopilot Pilot MembersneveryesTrue
Facilitiesemma.moe19_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Facilitieslars.lund14_adatum_dk#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Procurementliv.berg10_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comProcurement Visitors2026-03-28yesTrue
Procurementlars.holm18_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2025-07-10yesTrue
Procurementaxel.berg25_gmail_com#EXT#@contosonordics.onmicrosoft.comProcurement Members2026-05-09yesTrue
Kari Sandaxel.dahl29_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Procurementlars.lund14_adatum_dk#EXT#@contosonordics.onmicrosoft.comProcurement VisitorsneveryesTrue
Procurementola.jensen16_adatum_dk#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Productemma.moe19_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Financelars.holm18_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2025-07-10yesTrue
Marketingaxel.berg25_gmail_com#EXT#@contosonordics.onmicrosoft.comMarketing Members2026-05-09yesTrue
Legalemma.moe19_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing linkneveryesTrue
Procurementeva.lund9_fabrikam_com#EXT#@contosonordics.onmicrosoft.comProcurement Visitors2026-08-05noTrue
Compliancepetter.berg2_fabrikam_com#EXT#@contosonordics.onmicrosoft.comCompliance Members2026-08-11noTrue
Legacy Projectsmaria.holm28_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comLegacy Projects Members2026-08-21noTrue
Legacy Projectslars.nilsen27_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-14noTrue
Legacy Projectsanna.holm21_northwind_se#EXT#@contosonordics.onmicrosoft.comLegacy Projects Members2026-08-25noTrue
Archive 2019ola.jensen11_litware_fi#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-08noTrue
Archive 2019anna.nilsen23_adatum_dk#EXT#@contosonordics.onmicrosoft.comArchive 2019 Visitors2026-09-10noTrue
Erik Lundanna.holm21_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2026-08-25noTrue
Compliancetomas.berg6_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comCompliance Members2026-08-30noFalse
Lars Holmanna.nilsen23_adatum_dk#EXT#@contosonordics.onmicrosoft.comLars Holm Visitors2026-09-10noTrue
Lars Holmpetter.berg2_fabrikam_com#EXT#@contosonordics.onmicrosoft.comLars Holm Members2026-08-11noTrue
Maria Dahlaxel.koski4_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-04noTrue
Ola Nilseningrid.moe8_fabrikam_com#EXT#@contosonordics.onmicrosoft.comOla Nilsen Members2026-09-11noTrue
Ola Nilsenhenrik.nilsen7_fabrikam_com#EXT#@contosonordics.onmicrosoft.comOla Nilsen Visitors2026-09-08noTrue
Emma Moetomas.berg6_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing link2026-08-30noFalse
Emma Moepetter.berg20_fabrikam_com#EXT#@contosonordics.onmicrosoft.comEmma Moe Members2026-08-20noTrue
Erik Lundhanna.nilsen5_fabrikam_com#EXT#@contosonordics.onmicrosoft.comErik Lund Members2026-08-13noTrue
Financehanna.nilsen5_fabrikam_com#EXT#@contosonordics.onmicrosoft.comFinance Members2026-08-13noTrue
Marketinghanna.nilsen5_fabrikam_com#EXT#@contosonordics.onmicrosoft.comSharing link2026-08-13noTrue
Recruitinghenrik.nilsen7_fabrikam_com#EXT#@contosonordics.onmicrosoft.comRecruiting Visitors2026-09-08noTrue
Procurementlars.nilsen27_northwind_se#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-14noTrue
Procurementanna.nilsen23_adatum_dk#EXT#@contosonordics.onmicrosoft.comProcurement Members2026-09-10noTrue
Facilitieshenrik.moe26_litware_fi#EXT#@contosonordics.onmicrosoft.comSharing link2026-07-29noTrue
Facilitieshanna.nilsen5_fabrikam_com#EXT#@contosonordics.onmicrosoft.comFacilities Visitors2026-08-13noTrue
Facilitiesingrid.moe8_fabrikam_com#EXT#@contosonordics.onmicrosoft.comFacilities Members2026-09-11noTrue
Facilitiesmaria.holm28_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comFacilities Visitors2026-08-21noTrue
Legalhenrik.nilsen7_fabrikam_com#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-08noTrue
Recruitingjonas.jensen34_adatum_dk#EXT#@contosonordics.onmicrosoft.comRecruiting Visitors2026-08-04noTrue
Facilitiespetter.berg20_fabrikam_com#EXT#@contosonordics.onmicrosoft.comFacilities Visitors2026-08-20noTrue
Facilitiesmats.koski32_fabrikam_com#EXT#@contosonordics.onmicrosoft.comSharing link2026-07-20noTrue
Kari Sandlars.nilsen27_northwind_se#EXT#@contosonordics.onmicrosoft.comKari Sand Members2026-09-14noTrue
QAkari.koski33_litware_fi#EXT#@contosonordics.onmicrosoft.comQA Members2026-08-30noTrue
QAjonas.holm36_fabrikam_com#EXT#@contosonordics.onmicrosoft.comQA Visitors2026-08-14noTrue
QAola.dahl0_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-01noFalse
QAtomas.berg6_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comQA Visitors2026-08-30noFalse
Procurementtomas.berg6_wingtiptoys_no#EXT#@contosonordics.onmicrosoft.comProcurement Visitors2026-08-30noFalse
Facilitiesanna.nilsen23_adatum_dk#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-10noTrue
Financeingrid.moe8_fabrikam_com#EXT#@contosonordics.onmicrosoft.comSharing link2026-09-11noTrue

4. Broken inheritance (34 sites)

Libraries, folders and items with unique permissions. Each one is a place where "who can see this" differs from the site and nobody reviews it.

SiteUnique listsUnique itemsItems scannedTruncated
QA124895192False
Sales EMEA4243514442False
Marketing473510180False
Recruiting11667925False
Lars Holm01242169False
Nils Aas012411126False
M&A Project Falcon41192877False
Board4863120False
Research278809False
Copilot Pilot4372761False
Payroll2268420True
Customer Success4151879False
Emma Moe0141421False
Anna Berg0133975False
Erik Lund0131246False
Support Tier 21105308False
Engineering1105684False
Social Club49442False
Archive 201948169False
Events 202618102False
Petter Li08932False
Jonas Jensen064554False
HR245021False
News424001False
Kari Sand021222False
Maria Dahl011316False
Intranet118778False
Policies20660False
Benefits202017False
Security202813False
Templates106897False
Compliance107910False
All Hands1061000True
Facilities201199False

5. Ownership (7)

Sites nobody can approve a site access review for.

SiteKindIssueSite adminsGroup owners
M&A Project FalconTeam site (M365 group)M365 group has no owners00
RecruitingTeam site (M365 group)M365 group has no owners30
IntranetCommunication siteSingle site collection admin1
PoliciesCommunication siteSingle site collection admin1
NewsCommunication siteSingle site collection admin1
BenefitsCommunication siteSingle site collection admin1
TemplatesSiteNo site collection admin0

6. Sensitivity labels (15)

Unlabelled sites, and labelled sites whose sharing setting is looser than the label implies. Container labels need sensitivity labels enabled for groups & sites in Purview.

SiteKindLabelSharingIssue
Sales EMEATeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
HRTeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
LegalTeam site (M365 group)ConfidentialExternalUserAndGuestSharingLabel 'Confidential' but site allows Anyone links
BoardTeam site (M365 group)Highly ConfidentialExternalUserAndGuestSharingLabel 'Highly Confidential' but site allows Anyone links
IT OperationsTeam site (M365 group)(none)ExternalUserSharingOnlyNo sensitivity label
FacilitiesTeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
M&A Project FalconTeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
PayrollTeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
Copilot PilotTeam site (M365 group)(none)ExistingExternalUserSharingOnlyNo sensitivity label
ResearchTeam site (M365 group)Highly ConfidentialExternalUserAndGuestSharingLabel 'Highly Confidential' but site allows Anyone links
PartnersTeam site (M365 group)(none)ExistingExternalUserSharingOnlyNo sensitivity label
Data PlatformTeam site (M365 group)(none)ExternalUserAndGuestSharingNo sensitivity label
NewsCommunication site(none)ExternalUserSharingOnlyNo sensitivity label
Legacy ProjectsSiteConfidentialExternalUserAndGuestSharingLabel 'Confidential' but site allows Anyone links
Archive 2019Site(none)ExternalUserAndGuestSharingNo sensitivity label

7. Advisory (5)

SiteNote
(tenant)Tenant sharing setting is 'Anyone'; 18 of 47 sites can create Anyone links. Sites cannot be more permissive than the tenant; lowering the tenant setting to 'New and existing guests' makes existing Anyone links stop working.
(tenant)Anyone links never expire (RequireAnonymousLinksExpireInDays not set)
Maria DahlOneDrive with 1 Anyone link(s)
Kari SandOneDrive with 1 Anyone link(s)
(tenant)32 Anyone link(s) older than 180 days - nobody has reviewed whether they are still needed

Remediation order

  1. EEEU sites first. Replace Everyone / EEEU in Visitors with a real group; set public M365 groups to private where the content is not company-wide. This is the single largest Copilot-exposure lever.
  2. Anyone links with no expiry: set RequireAnonymousLinksExpireInDays at tenant level, then remove the listed links or let them expire.
  3. Stale guests: remove from sites, then delete the account (Entra ID → Users → guest) after a 30-day grace.
  4. Unique permissions: for the top sites, reset inheritance where the exception is no longer needed; keep a list of the deliberate ones.
  5. Ownerless sites: assign two owners before running a site access review — nobody can answer the review otherwise.
  6. Labels: label the unlabelled sites (Purview → sensitivity labels for containers) and align each label's default sharing scope.
  7. Re-run monthly; track the top-20 weighted scores as the exposure trend.