AB-900 - Understand data protection and governance tasks for Microsoft 365 and Copilot - Section 2.4

Identify and monitor oversharing in SharePoint in Microsoft 365.

The tools that diagnose oversharing, running a data access governance report in SharePoint, and SharePoint Advanced Management including restricted access control. Revised in the 22 July 2026 outline update. Oversharing is the single biggest practical risk Copilot exposes, so this objective carries more weight in practice than its size suggests.

data access governance reportSharePoint Advanced Managementrestricted access controlsite access reviewoversharing remediation

Practice question for this objective

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

A governance lead is comparing SharePoint Advanced Management with the standard SharePoint admin center. Which statement best describes what SharePoint Advanced Management adds for controlling oversharing ahead of a Microsoft 365 Copilot deployment?

  • AIt provides advanced governance controls such as restricted access control, data access governance insights, and site access reviews for managing sharing at scale. Correct
  • BIt replaces sensitivity labels with its own classification engine that Copilot reads instead of Microsoft Purview labels.
  • CIt grants Copilot a dedicated permission model so it can index sites the signed-in user cannot open.
  • DIt automatically encrypts every document in the tenant at rest so that broad sharing no longer exposes content.
SharePoint Advanced Management adds governance controls like restricted access control, richer reporting, and site access reviews. SharePoint Advanced Management is a paid add-on that extends the standard admin center with policies and insights, including restricted access control and site access reviews, letting administrators manage sharing at scale rather than site by site.

Why A is correct: SharePoint Advanced Management is an add-on that layers governance controls including restricted access control policies, richer data access governance reporting, and site access reviews, which is exactly what large tenants use to curb oversharing before Copilot.

Why B is wrong: This is tempting because both touch data protection, but SharePoint Advanced Management does not classify content or replace Microsoft Purview sensitivity labels, so the statement is wrong.

Why C is wrong: This plays on the misconception that a governance add-on changes Copilot access, but Copilot always inherits the user's existing permissions and has no separate access model, so nothing can grant it wider reach.

Why D is wrong: Tenant-wide encryption sounds protective, but SharePoint Advanced Management does not blanket-encrypt content, and encryption would not stop an over-permissioned user from reading a file, so it does not address oversharing.

See more AB-900 practice questions, answers explained.

More in this domain

Back to all Understand data protection and governance tasks for Microsoft 365 and Copilot objectives, or the AB-900 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.