Shares in Microsoft 365Who can access what?
You set in policies what may be shared in SharePoint, OneDrive and Teams. 365 Permissions checks every share against them and turns every share that does not comply with the policy into a task with a due date.
8 of 8 in the box · 3 shares cleaned up
To do
The most urgent tasks, grouped per location.
All 23 tasksSharing happens every day. Nobody sees the total.
A link for the tax adviser, the agency in the project team, a library for everyone to save time. Each decision made sense on its own. Over the years it adds up to an inventory that no admin console shows on one page.
The link for the tax adviserHigh“Anyone with the link” that allows viewing
The agency in the project teamMediumShare with a group that includes people outside
The library for everyoneHighShare with all employees
The project is over, the team staysHighLocation without an owner
Microsoft 365 Copilot and search show every person everything they can access. Whatever is shared too widely becomes easy to find. Anyone rolling out Copilot should know their sharing first.
Copilot and oversharingFrom inventory to a finished task.
An example in six steps: three “Anyone with the link” links that allow editing in the Sales location.
Every location measured against its policy
Teams, SharePoint sites and OneDrives each have one of four policies. At a glance you see which location does not comply and how far it is shared outside.
What does not comply becomes a task with a due date
Grouped per rule and location, by priority. Whatever is meant to stay is allowed as an exception with a reason and an end date and shows up that way in the report.
A preview before every change
The preview shows every entry that would change and, for every skipped one, the reason. Nothing changes in Microsoft 365 yet.
Approval by a second person
Whoever requests does not approve. Organizations with only one administrator can switch this off; preview and log remain.
Done and on record
Every entry ends as done, no longer present or failed. The log records request, approval and result.
Or automatically after the due date
If you want, 365 Permissions cleans up new shares that do not comply with the policy by itself once the due date has passed. It only applies after approval by a second person, at most 50 clean-ups per run, with an emergency stop.
| Location | |||
|---|---|---|---|
| SalesSharePoint site · InternalDoes not comply: 4 shares | Internal | 3 “Anyone with the link” · 12 people outside | Does not comply: 4 shares |
| Project Northern LightTeam · ConfidentialDoes not comply: 3 shares | Confidential | 5 people outside | Does not comply: 3 shares |
| AccountingSharePoint site · ConfidentialDoes not comply: 2 shares | Confidential | 1 to all employees | Does not comply: 2 shares |
| HRSharePoint site · Strictly confidentialComplies with the policy | Strictly confidential | Nothing outside | Complies with the policy |
| MarketingSharePoint site · PublicComplies with the policy | Public | 6 “Anyone with the link” | Complies with the policy |
A deleted link cannot be restored with the same address.
Requested by A. Schmidt on 17 Oct at 09:12. 3 entries, 1 skipped.
Whoever requests does not approve.
At most 50 clean-ups per run, otherwise the automatic clean-up pauses and reports back.
More ways through the same inventory.
Start from a person or group, owner review and proof for auditors.
What a person or group can access
For a person outside, a former employee or a directory group, 365 Permissions shows everything they reach: directly, through links, through groups and through roles. Nested groups are included.
- People outside by domain
- Expand the members of a group in place
- Remove all access of a person outside in one step
Owner review
The owners of teams, SharePoint sites and OneDrives get an email with a personal link. They decide per share: keep or remove. IT approves every removal.
- Scope of your choice: people outside, links or all shares
- Due date with reminder, new review at a fixed interval
- Owners need no Conbool account
Team Project Northern Light
Please decide by 31 Oct 2026. IT confirms whatever you remove.Reports as PDF and CSV, notifications by email or Teams
Six reports, each as a PDF to pass on and as a CSV file for Excel: overview, tasks, locations, access from outside, all shares and people. After the first scan, the scan runs daily and reports what is new.
- Daily scan, weekly if you prefer
- Notification when new shares with priority High or Critical appear, an organization-wide setting no longer matches the recommendation or the scan fails
- Alerts to Microsoft Teams without file or person names
Sample organization · as of 18 Oct 202623open tasks
Four policies. You decide who may read along.
Every location has a policy: a team with its SharePoint site, a SharePoint site or a OneDrive. The default policy applies to every location without its own, single locations get another one, for example Strictly confidential for HR. Before you save, you see which shares will then not comply with the policy.
See all 15 rules per policy
| Rule | Priority | 7 / 60 days | 7 / 30 days | 3 / 14 days | 1 / 7 days |
|---|---|---|---|---|---|
| Links | |||||
| “Anyone with the link” that allows editing. | Critical | ||||
| “Anyone with the link” that allows viewing. | High | ||||
| Link for everyone in the organization in a confidential location. | High | ||||
| Link without an expiration date. | Low | ||||
| Link to a file from a Teams chat without an expiration date.applies once a period is set | Low | ||||
| People outside and all employees | |||||
| Share with all employees. | High | ||||
| Share with a private mailbox. | Medium | ||||
| Share with a person outside without a guest account. | Medium | ||||
| People outside in Teams and groups | |||||
| Share with a group that includes people outside. | Medium | ||||
| Public team. | Medium | ||||
| People outside in the team. | Medium | ||||
| Ownership and structure | |||||
| Location without an owner. | High | ||||
| Only one owner. | Low | ||||
| Share of a deleted account. | Low | ||||
| Very many individual shares.from 1000 · 100 · 25 per location | Low | ||||
Due dates: priority Critical / all others, counted from the first finding. The rules judge names, types and numbers. What is inside a file is neither read nor assessed.
The organization-wide settings count too.
Ten Microsoft 365 settings decide what can be shared at all. 365 Permissions shows target and actual for each. Nothing is changed; you make the change yourself in Microsoft 365.
| SharePoint and OneDrive | |
|---|---|
| No “Anyone with the link” links | As recommended |
| People outside may not reshareActual: allowed | Not as recommended |
| Legacy protocols in SharePoint off | As recommended |
| Invited address must match the account | As recommended |
| People outside and apps | |
| Only admins and authorised people invite people outside | As recommended |
| Users do not consent to apps themselves | As recommended |
| Users do not register apps | As recommended |
| Sign-in | |
| MFA for administrators | As recommended |
| Legacy protocols blocked at sign-in | As recommended |
| Administrators | |
| Two to four global administratorsActual: 6 | Not as recommended |
Sample data. Every setting ends as As recommended, Not as recommended or Not checked.
All customers in one table. The greatest need on top.
- Tasks by priority per customerplus the organization-wide settings that do not match the recommendation and the last scan, also as a CSV file for Excel.
- The same recommendations for every customerThe organization-wide settings per customer and per setting side by side.
- In the same partner portalnext to MailGuard, Archive and 365 Backup. Included in Suite 3 or per user.
| Customer | Critical | High | Settings open | Last scan |
|---|---|---|---|---|
| Tax office | 3 | 12 | 3 | today 06:00 |
| Engineering | 1 | 9 | 2 | today 06:00 |
| Medical practices | 0 | 7 | 4 | yesterday 06:00 |
| Design office | 0 | 2 | 1 | today 06:00 |
| Retail | 0 | 1 | 0 | today 05:30 |
What the connection reads and what it does not.
- Read
- A global administrator grants permission once. The app requires full access to all locations and uses it for reading only.
- Clean up
- A second app with its own permission. Without it, 365 Permissions stays read-only.
- Never
- File contents. Names, paths, shares and their recipients are captured.
Three steps to the first task.
- 1Allow read accessIn the portal, by a global administrator. Nothing changes in Microsoft 365.
- 2First scanIt finds all locations, groups, people outside and shares. After that it runs daily.
- 3Assign policies, finish tasksMost important first; allow an exception for whatever is meant to stay, clean up the rest with a preview.
Hosted in German data centres, contract with a vendor from Hamburg.
Frequently asked questions
What is Microsoft 365 governance?
The rules and controls for who may access what in Microsoft 365 and how content is shared. Conbool 365 Permissions covers the part that can be measured: shares, people outside, owners and the organization-wide settings of Microsoft 365.
Can I create my own policies?
Yes. You choose one of four policies as the default policy and assign another one to locations: per location, by name, for the OneDrives of a group or for single folders, for example Strictly confidential for HR. Each policy says in one sentence who may read along. Before you save, you see which shares will then not comply with the policy.
Can I treat Excel differently from Word?
Not with 365 Permissions. Microsoft 365 does not distinguish file types when sharing. Rules by file type are only offered by Microsoft Purview, which needs its own licence. We are happy to advise you.
Does Conbool read file contents?
No. Locations, names, paths, shares and their recipients are captured. The content of a file is not opened, classified or stored. That is why the product is not a data loss prevention solution.
Which permission does the connection need?
A global administrator grants permission once for an app with Microsoft Graph application permissions. It requires full access to all locations, because the shares of individual files cannot be read otherwise, and uses it for reading only. Microsoft calls this permission Sites.FullControl.All. If a role is missing, the affected setting stays as not checked.
Does the product change anything in Microsoft 365?
Only on explicit request. Clean-ups need a second app with its own permission and show a preview first. By default a second person has to approve; organizations with only one administrator can switch this off. Possible are: delete a link, remove a share, set an expiration date, change to view only and remove all access of a person outside. The organization-wide settings are checked but not changed.
Can owners review their own locations?
Yes. The owners of teams, SharePoint sites and OneDrives get an email with a personal link and decide per share whether it stays or is removed. IT approves every removal. Due date, reminder and interval of the review can be set.
Does this help with rolling out Microsoft 365 Copilot?
Yes, as preparation. Copilot finds everything each person may access. Content shared too widely becomes easier to find. 365 Permissions shows these shares and helps to clean them up before the rollout. The product does not intervene in Copilot itself.
Does this replace Microsoft Secure Score or a CIS benchmark?
No. The organization-wide settings cover ten settings of the Conbool Basis recommendation and are not a complete benchmark. The focus is on what configuration assessments do not show: the single share, the single person outside and the location without an owner.
Can it prove a permission concept?
The reports as PDF and CSV show open tasks, exceptions with reasons, all shares and the organization-wide settings as of the last scan. They document the actual state in Microsoft 365. The concept itself, who should access what, is yours to define.
Does the product cover Exchange and mailbox permissions?
No. It covers SharePoint, OneDrive, Teams, Microsoft 365 groups and people outside with a guest account. Mailbox permissions and licence management are out of scope.
How is 365 Permissions licensed?
Included in Suite 3 or booked separately per user.
Who is the partner view for?
For IT service providers and managed service providers who look after the Microsoft 365 of several customers. It shows per customer the open tasks by priority, the organization-wide settings that do not match the recommendation and the last scan, the customer with the greatest need first.
Know who can access what.
We show 365 Permissions on your own Microsoft 365: from the first scan to the first finished task.