Copilot exposure self-check

Six questions about your own tenant. Answer them as they actually are today, not as the policy says they should be. Your rating appears as soon as all six are answered — no email address required.

0 of 6 answered

1. 1. When did someone last review who can access each SharePoint site?

   Never, or nobody here would knowAt some point, more than two years agoWithin the last twelve months, on a schedule

2. 2. Do any sites or libraries still use “Everyone except external users”?

   Probably, or we have not checkedA few, and we know which onesNone — we checked and removed them

3. 3. Are sensitivity labels applied to client and matter files?

   No labels, or labels exist but nothing is labelledPublished, applied inconsistently by staffApplied automatically against defined conditions

4. 4. Can staff create sharing links that work without signing in?

   Yes, anyone with the link can open itRestricted to signed-in users, with exceptionsAnonymous links are disabled tenant-wide

5. 5. Do you have a retained record of what Copilot has been asked and what it returned?

   No, or we would not know where to lookAudit logging is on, but nobody reviews itRetained, and reviewed on a defined cadence

6. 6. When someone leaves, how fast do their shares and delegated permissions go?

   Unclear — the account gets disabled and that is itWithin a few weeks, handled ad hocSame day, against a documented offboarding checklist