Control 1.3: SharePoint Content Governance and Permissions

Overview

Control ID: 1.3 Control Name: SharePoint Content Governance and Permissions Regulatory Reference: GLBA 501(b), 504(b), SEC Reg S-P, FINRA 4511 Setup Time: 2-4 hours (initial configuration); ongoing management

Purpose

SharePoint is often the primary knowledge source for Copilot Studio agents. Proper content governance ensures agents only access authorized data and prevents inadvertent exposure of sensitive customer information. This control is critical for:

GLBA 501(b): Safeguarding customer NPI stored in SharePoint
SEC Reg S-P: Protecting customer records in document libraries
FINRA 4511: Maintaining books and records with appropriate access controls
Data Minimization: Ensuring agents access only necessary content
Oversharing Prevention: Stopping accidental exposure through AI responses

Prerequisites

Primary Owner Admin Role: SharePoint Admin Supporting Roles: SharePoint Site Collection Admin

Required Licenses

SharePoint Online (included in Microsoft 365 E3/E5)
Microsoft 365 E5 or SharePoint Advanced Management (for enhanced controls)
Microsoft Purview (for sensitivity labels)

Required Permissions

SharePoint Administrator (tenant-level settings)
Site Collection Administrator (site-level configuration)
Purview Compliance Administrator (sensitivity labels)

Dependencies

Control 1.5 (DLP & Sensitivity Labels): Labels must be created before applying to sites/libraries
Control 4.1 (IAG): Information Access Governance for restricted content discovery

Pre-Setup Checklist

[ ] Audit existing SharePoint sites with sensitive data
[ ] Identify sites that will be agent knowledge sources
[ ] Define sensitivity label taxonomy
[ ] Create site templates for FSI governance
[ ] Document external sharing requirements
[ ] Plan access review schedule

Governance Levels

Baseline (Level 1)

Least-privilege SharePoint permissions; restrict external sharing; label sensitive libraries.

Recommended (Level 2-3)

Standardized site templates + sensitivity labels; periodic access reviews; restrict agent access to approved sites.

Regulated/High-Risk (Level 4)

Admin-controlled permissions with legal review; immutable retention; continuous access monitoring.

Setup & Configuration

Portal Path: SharePoint Admin Center → Policies → Sharing

Navigate to SharePoint Admin Center
Go to Policies → Sharing
Configure organization-level settings:

FSI Recommended Settings:

Setting	Recommended Value	Rationale
External sharing level	Only people in your organization	Prevent accidental customer data exposure
File and folder links	Only people in your organization	No anonymous links
Allow or block sharing with specific domains	Block consumer domains (gmail.com, yahoo.com)	Prevent consumer email sharing
Guests must sign in using the same account	Enabled	Ensure accountability
Allow guests to share items they don't own	Disabled	Prevent chain sharing
Guest access expires automatically	30-90 days	Limit persistent guest access

Click Save

Step 2: Configure Site-Level Settings for Agent Knowledge Sources

Portal Path: SharePoint Admin Center → Sites → Active sites → [Select site]

For each SharePoint site that agents will use as a knowledge source:

Select the site → Click Sharing
Set sharing level:
Enterprise-managed agents: Only people in your organization
Team collaboration agents: New and existing guests (with approval)
Personal productivity agents: Site owner discretion
Click Permissions → Advanced permissions settings
Review and configure:
Remove Everyone and Everyone except external users groups
Add specific security groups with appropriate roles
Document all permission grants

Configure Site Settings in SharePoint:

Navigate to the site directly
Go to Site settings (gear icon → Site information → View all site settings)
Under Site Administration:
Site permissions: Verify minimal permission grants
Site collection features: Enable required features
Under Site Actions:
Manage site features: Enable auditing if available

Step 3: Apply Sensitivity Labels to Sites and Libraries

Portal Path: Microsoft Purview → Information protection → Labels

Apply Label at Site Level

In SharePoint Admin Center → Sites → Active sites
Select the site → Policies tab
Under Sensitivity, click Edit
Select appropriate label:
Confidential-FSI for customer data
Highly Confidential for trading/material non-public information
Internal for general business content
Click Save

Apply Label at Library Level

Navigate to the document library in SharePoint
Click Settings (gear) → Library settings
Under Permissions and Management:
Click Apply sensitivity label to items in this list or library
Select the appropriate default label
Choose whether to:
Apply label to existing items: Recommended for initial deployment
Apply label only to new items: For ongoing governance

Step 4: Create Restricted Sites for Sensitive Agent Knowledge

Portal Path: SharePoint Admin Center → Sites → Create

Create dedicated sites for agent knowledge sources:

Click Create → Choose Team site or Communication site
Configure site settings:
Site name: Agent-Knowledge-[AgentName] or FSI-AgentData-[Zone]
Privacy settings: Private
Language: English
After creation, configure:
External sharing: Only people in your organization
Apply sensitivity label: Appropriate FSI label
Site permissions: Only agent service accounts + content owners

Step 5: Configure Information Access Governance (IAG)

Portal Path: SharePoint Admin Center → Sites → Active sites → Restricted access control

For enterprise-managed agent knowledge sources:

Select the site containing sensitive data
Click Policies → Restricted access control
Enable Restrict access to this site
Add specific users or groups who can access
This creates an additional layer beyond standard permissions

Configure Restricted Content Discoverability:

Navigate to SharePoint Admin Center → Content services → Information access governance
Create a new restricted content discoverability policy
Define:
Sites/content to restrict
Users/groups who can discover restricted content
Exceptions for agents that need access

Step 6: Configure Access Reviews for Agent Knowledge Sites

Portal Path: Microsoft Entra → Identity Governance → Access Reviews

Navigate to Entra Admin Center → Identity Governance → Access Reviews
Click + New access review
Configure:
Name: Agent-Knowledge-Sites-Quarterly-Review
Scope: SharePoint site(s) used by agents
Reviewers: Site owners or designated governance team
Frequency: Quarterly (for enterprise-managed) or Semi-annually (team collaboration)
Duration: 14 days
Under Upon completion settings:
Auto-apply results: Consider for personal productivity / team collaboration
If reviewers don't respond: Remove access (for enterprise-managed)
Create the access review

Step 7: Configure PowerShell Site Governance

# SharePoint Content Governance Configuration
# Requires: SharePoint Online Management Shell

# Install module if needed
Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Force

# Connect to SharePoint Online
$AdminUrl = "https://contoso-admin.sharepoint.com"
Connect-SPOService -Url $AdminUrl

# Get all sites and their sharing settings
$Sites = Get-SPOSite -Limit All
$SiteReport = $Sites | Select-Object Url, Title, Owner, SharingCapability,
    ConditionalAccessPolicy, SensitivityLabel, LockState |
    Export-Csv "C:\Governance\SharePoint-Sites-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Configure a site for an enterprise-managed agent knowledge source
$AgentKnowledgeSite = "https://contoso.sharepoint.com/sites/Agent-CustomerService"

Set-SPOSite -Identity $AgentKnowledgeSite `
    -SharingCapability Disabled `
    -DisableSharingForNonOwners $true `
    -DefaultLinkPermission View `
    -ConditionalAccessPolicy AllowLimitedAccess `
    -LimitedAccessFileType OfficeOnlineFilesOnly

# Apply sensitivity label to site (requires Graph API)
# Connect to Graph
Connect-MgGraph -Scopes "Sites.ReadWrite.All", "InformationProtectionPolicy.Read"

# Get the site ID
$Site = Get-MgSite -SiteId "contoso.sharepoint.com:/sites/Agent-CustomerService"

# Get available labels
$Labels = Get-MgInformationProtectionLabel
$TargetLabel = $Labels | Where-Object { $_.Name -eq "Confidential-FSI" }

# Apply label to site
# Note: Site sensitivity labels are set via site classification during creation
# or via the SharePoint Admin Center for existing sites

# Remove overly permissive groups from sites
$AgentSites = @(
    "https://contoso.sharepoint.com/sites/Agent-CustomerService",
    "https://contoso.sharepoint.com/sites/Agent-Trading",
    "https://contoso.sharepoint.com/sites/Agent-Compliance"
)

foreach ($SiteUrl in $AgentSites) {
    # Get site groups
    $Site = Get-SPOSite -Identity $SiteUrl -Detailed

    # Remove Everyone and Everyone except external users if present
    try {
        Remove-SPOUser -Site $SiteUrl -LoginName "c:0(.s|true"  # Everyone
        Write-Host "Removed 'Everyone' from $SiteUrl" -ForegroundColor Yellow
    } catch {
        Write-Host "'Everyone' not found on $SiteUrl" -ForegroundColor Gray
    }

    try {
        Remove-SPOUser -Site $SiteUrl -LoginName "c:0-.f|rolemanager|spo-grid-all-users/$($Site.Id)"
        Write-Host "Removed 'Everyone except external users' from $SiteUrl" -ForegroundColor Yellow
    } catch {
        Write-Host "'Everyone except external' not found on $SiteUrl" -ForegroundColor Gray
    }
}

# Generate permission report for agent knowledge sites
$PermissionReport = @()

foreach ($SiteUrl in $AgentSites) {
    $SiteUsers = Get-SPOUser -Site $SiteUrl -Limit All

    foreach ($User in $SiteUsers) {
        $PermissionReport += [PSCustomObject]@{
            Site = $SiteUrl
            LoginName = $User.LoginName
            DisplayName = $User.DisplayName
            IsSiteAdmin = $User.IsSiteAdmin
            Groups = ($User.Groups -join "; ")
        }
    }
}

$PermissionReport | Export-Csv "C:\Governance\AgentSites-Permissions-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Permission report exported" -ForegroundColor Green

# Configure external sharing for each site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Agent-CustomerService" `
    -SharingCapability Disabled

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Agent-Trading" `
    -SharingCapability Disabled

# Enable auditing at tenant level
Set-SPOTenant -DisabledWebPartIds @() # Ensure web parts not blocking audit
# Note: Unified audit log is enabled via Security & Compliance Center

Financial Sector Considerations

Regulatory Alignment

Regulation	SharePoint Governance Requirement
GLBA 501(b)	Restrict access to sites containing customer NPI; log access
SEC Reg S-P	Privacy safeguards for customer records in document libraries
FINRA 4511	Maintain books and records with access controls; audit trail
SOX 302/404	Segregation of duties for financial document access

Zone-Specific Configuration

Zone 1 (Personal Productivity)

Site Sharing: Site owner discretion
External Sharing: Organization-wide setting
Sensitivity Labels: Recommended but not required
Access Reviews: Annual
Permissions: Standard SharePoint groups

Zone 2 (Team Collaboration)

Site Sharing: Existing guests only (with approval)
External Sharing: Specific partner domains only
Sensitivity Labels: Required - minimum "Internal"
Access Reviews: Semi-annual
Permissions: Named security groups only

Zone 3 (Enterprise Managed)

Site Sharing: Organization only (no external)
External Sharing: Disabled completely
Sensitivity Labels: Required - "Confidential-FSI" or higher
Access Reviews: Quarterly
Permissions: Named individuals + service accounts only
Additional: IAG/Restricted Content Discoverability enabled

FSI Configuration Example: Wealth Management Firm

Scenario: A wealth management firm uses Copilot Studio agents to answer client questions using portfolio documentation stored in SharePoint.

SharePoint Structure:

/sites/ClientPortfolios-WM/
├── Client-Onboarding/          [Sensitivity: Highly Confidential]
│   ├── KYC Documents/
│   ├── Account Opening Forms/
│   └── Risk Assessments/
├── Investment-Research/        [Sensitivity: Confidential-FSI]
│   ├── Analyst Reports/
│   ├── Market Data/
│   └── Model Portfolios/
├── Agent-Knowledge-Base/       [Sensitivity: Confidential-FSI]
│   ├── Product Information/
│   ├── Fee Schedules/
│   ├── FAQ Content/
│   └── Approved Disclosures/
└── Compliance-Archive/         [Sensitivity: Highly Confidential - Regulatory]
    ├── Audit Reports/
    ├── Regulatory Correspondence/
    └── Examination Materials/

Agent Configuration:

Client Inquiry Agent (enterprise-managed):
Access: /Agent-Knowledge-Base/ only
Permissions: Read-only via service account
Sensitivity: Can only return Confidential or lower content
Excluded: Client-Onboarding (PII), Compliance-Archive
Internal Research Agent (team collaboration):
Access: /Investment-Research/ + /Agent-Knowledge-Base/
Permissions: Read via analyst security group
Sensitivity: Can access Confidential-FSI content

Governance Measures:

Weekly access review for Client Inquiry Agent service account
Audit log monitoring for unusual access patterns
Quarterly recertification of agent data source permissions
DLP policies prevent agent from exposing SSN, account numbers in responses

Verification & Testing

Verification Steps

Confirm Tenant Sharing Settings:
SharePoint Admin Center → Policies → Sharing
EXPECTED: External sharing restricted per FSI requirements
Verify Site-Level Permissions:
Navigate to agent knowledge source site
Site settings → Site permissions
EXPECTED: Only approved groups/users; no "Everyone" groups
Test Agent Access Boundaries:
Ask agent to retrieve content from excluded site
EXPECTED: Agent cannot access or returns "no information found"
Validate Sensitivity Labels:
Check document library → Information panel
EXPECTED: All documents have appropriate sensitivity labels
Confirm External Sharing Blocked:
Attempt to share a document externally from an enterprise-managed site
EXPECTED: Sharing blocked with appropriate message
Test Access Review Notification:
Check that access review notifications are being sent
EXPECTED: Reviewers receive notification per schedule

Verification Evidence

[ ] Screenshot: Tenant-level sharing settings
[ ] Export: Site inventory with sharing settings (CSV)
[ ] Screenshot: Agent knowledge site permissions
[ ] Export: Permission audit for all agent data sources
[ ] Screenshot: Sensitivity labels applied to libraries
[ ] Documentation: Access review schedule and results

Troubleshooting & Validation

Issue: Agent Cannot Access Required Content

Symptoms: Agent returns "I don't have access to that information" for valid content

Solutions:

Verify agent service account is in site members group
Check sensitivity label on content matches agent's allowed labels
Confirm IAG/restricted content discoverability isn't blocking
Review Conditional Access policies that might block service account
Check if site requires MFA and service account can satisfy

Issue: Agent Accessing Content It Shouldn't

Symptoms: Agent returning sensitive information from excluded sites

Solutions:

Review agent knowledge source configuration in Copilot Studio
Verify site permissions don't include broad groups
Check for inheritance from parent site
Remove any "Everyone" or "All Users" permissions
Verify sensitivity labels are correctly applied and enforced

Issue: Sensitivity Labels Not Appearing on Documents

Symptoms: Documents don't show expected sensitivity labels

Solutions:

Verify labels are published to users in the site
Check if auto-labeling policies are configured
Confirm user has Information Protection client installed
Review if default library label is configured
For existing documents, may need to apply label retroactively

Symptoms: Users can share externally from restricted sites

Solutions:

Check site-level override vs. tenant settings (site can't be more permissive)
Verify setting saved correctly (refresh admin center)
Check for PowerShell scripts that may be resetting values
Confirm user isn't a site collection admin (different permissions)
Review SharePoint feature flags for new sharing features

Additional Resources

Control	Relationship
Control 1.5	Sensitivity labels for content classification
Control 4.1	IAG for advanced content restrictions
Control 4.2	Access reviews for SharePoint sites
Control 4.4	Guest access management
Control 1.14	Data minimization for agent scope

Support & Questions

For implementation support or questions about this control, contact:

SharePoint Administrator: Site configuration and permissions
Information Protection Team: Sensitivity labels and DLP
Compliance Officer: Regulatory requirements and evidence
AI Governance Lead: Agent data source approval

Updated: Dec 2025
Version: v1.0 Beta (Dec 2025)
UI Verification Status: ❌ Needs verification

Control 1.3: SharePoint Content Governance and Permissions

Overview

Purpose

Prerequisites

Required Licenses

Required Permissions

Dependencies

Pre-Setup Checklist

Governance Levels

Baseline (Level 1)

Recommended (Level 2-3)

Regulated/High-Risk (Level 4)

Setup & Configuration

Step 1: Configure Tenant-Level Sharing Settings

Step 2: Configure Site-Level Settings for Agent Knowledge Sources

Step 3: Apply Sensitivity Labels to Sites and Libraries

Apply Label at Site Level

Apply Label at Library Level

Step 4: Create Restricted Sites for Sensitive Agent Knowledge

Step 5: Configure Information Access Governance (IAG)

Step 6: Configure Access Reviews for Agent Knowledge Sites

Step 7: Configure PowerShell Site Governance

Financial Sector Considerations

Regulatory Alignment

Zone-Specific Configuration

Zone 1 (Personal Productivity)

Zone 2 (Team Collaboration)

Zone 3 (Enterprise Managed)

FSI Configuration Example: Wealth Management Firm

Verification & Testing

Verification Steps

Verification Evidence

Troubleshooting & Validation

Issue: Agent Cannot Access Required Content

Issue: Agent Accessing Content It Shouldn't

Issue: Sensitivity Labels Not Appearing on Documents

Issue: External Sharing Still Possible Despite Settings

Additional Resources

Related Controls

Support & Questions