Living inventory of SharePoint sites, Teams, OneDrive patterns, and shared mailboxes that Copilot and AI tools will search and summarize. Records access levels, sharing settings, remediation status, and review sign-off dates.
Copilot and AI tools respect permissions — but only if permissions are correct. This document is the answer to the question every auditor asks before a Copilot deployment: do you know where your sensitive data lives and who can access it?
The goal is not a perfect inventory of every file. It is a documented, reviewed, and signed-off map of the highest-risk and highest-activity repositories that AI tools will search. A completed, dated, signed copy of this document is auditable evidence for SOC 2 CC6.1 and CC6.6, and directly supports Copilot readiness.
Document your top SharePoint sites by activity and risk. Focus on the 20 highest-activity or highest-sensitivity sites first. Use the SharePoint Admin Center (Active Sites report) to identify sites by storage, page views, or sharing activity.
| SITE NAME | URL / PATH | CONTENT TYPE | ACCESS LEVEL | EXTERNAL SHARING | SENSITIVITY LABEL | RISK | STATUS |
|---|---|---|---|---|---|---|---|
Document Teams with broad membership, external guests, or sensitive channel content. Copilot summarizes Teams conversations — membership hygiene here directly affects what AI can surface to which users.
| TEAM NAME | MEMBERSHIP COUNT | GUESTS PRESENT | CHANNEL CONTENT TYPE | SENSITIVITY LABEL | RISK | STATUS |
|---|---|---|---|---|---|---|
Identify the users with the highest external share counts in OneDrive. Use the SharePoint Admin Center Reports section — OneDrive usage and sharing reports — to pull the top 20 sharers. Look specifically for "anyone with link" shares that have no expiration date.
| USER / ACCOUNT | ROLE / DEPT | EXTERNAL SHARES (COUNT) | ANYONE-WITH-LINK SHARES | OLDEST SHARE DATE | STATUS |
|---|---|---|---|---|---|
Shared mailboxes with broad access are frequently overlooked. Copilot can summarize shared mailbox content for anyone who has access — including anyone who was added years ago and never removed. Document and review all shared mailboxes with access broader than 5 members.
| MAILBOX NAME | EMAIL ADDRESS | CONTENT TYPE | MEMBER COUNT | LAST ACCESS REVIEWED | STATUS |
|---|---|---|---|---|---|
Log every oversharing issue identified, who owns the remediation, and when it was resolved. This is the evidence that permissions cleanup actually happened — not just that problems were noted.
| REPOSITORY / ITEM | ISSUE IDENTIFIED | OWNER | DUE DATE | RESOLVED DATE | STATUS |
|---|---|---|---|---|---|
Sign off on this review only when the inventory is complete, remediation items have owners and due dates, and the summary reflects the current state of the environment. A dated, signed sign-off converts this working document into auditable evidence.