To clear overshared SharePoint before a Copilot rollout, start with SharePoint Advanced Management, which comes with your first Copilot licence, and hold off on E5 or Varonis until a measured failure justifies them.
Varonis is the better cleanup tool and Purview is the better runtime control, so they rarely substitute for each other. The loser is an E5 upgrade bought only to fix permissions: Microsoft documents a maximum of 10 SharePoint sites for Purview's item-level scan. Prices below were checked on November 3, 2026.
| SharePoint Advanced Management (SAM) | Microsoft Purview DSPM and DLP | Varonis for Microsoft 365 | |
|---|---|---|---|
| Best at | Containing risky sites, delegating reviews | Stopping Copilot from using labeled content | Bulk permission and link remediation |
| Licence | One assigned Copilot licence on an eligible base plan | E5 tier for assessments and file DLP | Separate contract |
| List price | Included; Copilot is $30 per user per month, paid yearly | E5 is $60 per user per month | Contact sales |
| Weak spot | Depends on site owners or your own scripts | 10-site item-level scan, needs good labels | Vendor claims, and a pending sale to Proofpoint |
| Skip it if | You have no Copilot seats planned | You only need permission cleanup | You have few sites and clean labels |
| Verdict | Start here | Add for labels and DLP | Buy on measured failure |
What Copilot Oversharing Is and Why It Falls to You
Oversharing is content a user is permitted to open but has no business reason to see. Every Copilot prompt runs in the security context of the user who submits it, so it reaches only what that person can already open. Copilot makes a forgotten permission easy to find. Fixing the permission stays your job, and all three options here attack that from a different side.
What Each Option Costs at 5,000 Users
SAM adds nothing to a Copilot purchase, while an E5 upgrade for everyone costs $1.26 million a year at list. To compare like for like, assume 5,000 users on Microsoft 365 E3, 2,000 SharePoint sites and a first wave of 500 Copilot seats.
| Option | Extra annual cost at this workload | Source and caveat |
|---|---|---|
| SAM | $0 on top of seats. The seats cost 500 × $30 × 12 = $180,000 | Copilot list price |
| E3 to E5 for everyone | $21 × 5,000 × 12 = $1,260,000 | E3 $39, E5 $60, effective July 1, 2026 |
| E5 Information Protection and Governance add-on | $84 × 5,000 = $420,000 | Third-party reading of the September 2026 price list, so confirm with your reseller |
| Varonis for Microsoft 365 | Contact sales | See below |
Varonis publishes no price on its product page, which offers a demo and marketplace links. The one public reference point is a UK G-Cloud 15 reseller list showing £208.83 per unit in the 4,001-6,000 user band. If that unit is one user for one year, which the price tables do not state, the list total is about £1.04 million. Treat it as a government list price and never as a quote. The same sheet carries a separate "Data Access Governance for M365" line at £28.11 in that band, so ask your rep what the smaller module covers.
Which Copilot Controls Need E5 and Which Come With the Licence
SAM comes from the Copilot licence or a separately purchased Plan 1 add-on, and the E5 you already own does not include it. Microsoft's comparison page says SAM "requires the Microsoft Copilot add-on" on both E3 and E5. An E5 tenant without Copilot gets limited governance reports with no snapshot reports or remedial actions.
| Control | What you need |
|---|---|
| Site access reviews, Restricted Content Discovery, restricted access control, sharing link and permission reports | At least one user assigned a Copilot licence, on an eligible base plan |
| Sensitivity label report in SAM | The above, plus E5 or G5 |
| Targeted data risk assessments and policy suggestions in DSPM | A5, E5 or G5 |
| Automatic sensitivity labeling | E5 tier |
| DLP that stops Copilot processing labeled files and emails | Microsoft 365 E5, Purview Suite, E5 Information Protection and Governance, or Office 365 E5 |
| DLP on prompts | All Copilot and Copilot Chat users |
Two gaps are worth raising with your reseller. The Microsoft pages reviewed here do not say whether the $84 add-on carries DSPM assessments as well as file DLP. Microsoft 365 Business Premium is missing from the SAM base plan list, although the feature page mentions business customers. Also expect a surprise in the admin center: Tony Redmond reported in May 2025 that access is granted by a code check for Copilot and that SAM does not appear in the tenant's subscriptions.
What SharePoint Advanced Management Fixes, and Where It Stalls
SAM gives you the fastest containment and a workable review process, and its cleanup depends on people or scripts. SharePoint Advanced Management is Microsoft's governance layer for SharePoint and OneDrive, run from the admin center. Three of its controls do most of the work.
Restricted Content Discovery (RCD) keeps a site out of organization-wide search and Copilot responses without changing permissions. Microsoft calls it temporary and warns against excessive use. It does not cover OneDrive, and sites above 500,000 items can take more than a week to update. Geri Crroj of TenantCraft suggests that a list growing past about a dozen sites means you are hiding content you should be fixing. Test recently opened files yourself: the RCD page says they are restricted too, while the licence feature table says "unless a user had a recent interaction." If you still use the older allow-list, Restricted SharePoint Search is retiring, and new enablement has been blocked since July 31, 2026.
Restricted access control is the harder stop. Users outside the named groups cannot open the site "even if they had prior permissions or a shared link," and Copilot honors that. Use it on payroll, M&A and board sites, where RCD's unchanged permissions are too weak. Each site takes up to 10 groups, and shared and private channel sites must be configured separately.
Site access reviews send the problem to site owners. You can start 100 from the web view and more through PowerShell, with a cap of 1,000 a month from the site permissions report. A review stays "pending" until the owner completes it, and the documentation describes no consequence for ignoring one.
The gap in the native stack is at the item level. The sharing links report ranks sites by links created recently, shows the top 100 in the portal and needs PowerShell for OneDrive. Owners see the affected files, but admins start from a site list. For bulk work, the special groups report lists every item shared with "Everyone except external users" or "Everyone," up to 1 million rows, every 30 days. Microsoft pitches it for fixing oversharing "through scripting, rather than depending on individual site owners." That is a real path if you have someone to write and own those scripts. You also build the rollback yourself, and that labor is what Varonis's automation is sold to replace.
Where Purview Earns Its Licence
Purview earns its cost as a runtime control over labeled content, and it is a weak mass-cleanup tool. DSPM (data security posture management) is Purview's dashboard for finding and acting on sensitive data risk. Microsoft now labels DSPM for AI "classic" and points new work to current DSPM, so older guides use the wrong name.
The data risk assessment limits set the boundary. The default assessment runs weekly on the top 100 sites by usage. Item-level scanning has "a current maximum of 10 SharePoint sites," excludes OneDrive and needs an Entra app with Files.ReadWrite.All and Sites.ReadWrite.All, which your security team will want to review. The page does not say whether the 10-site cap applies per assessment or across the tenant, so ask Microsoft whether repeated custom assessments get you past it. The scan flags items with a sharing link for external or anonymous users. A "People in the organization" link can be forwarded to any colleague, and that definition does not flag it, even though Copilot's reach runs on internal access. The site-level Monitor tab does count items shared with everyone in the organization, but that count is not an item-level remediation list. Microsoft also tells you to use the Remove sharing link action "sparingly."
Microsoft's counterargument is that current DSPM "can automate remediation steps, such as removing public sharing links," with AI agents acting under your approval. Test that in your tenant, since the limits above sit on a page updated in June 2026.
DLP is the reason to pay for Purview. A DLP policy on the Copilot location stops Copilot processing files and emails with chosen labels, whoever has access. It has three limits. It works only as far as your labels do, the blocked item can still appear in citations, and DLP cannot scan files uploaded directly into a prompt. Blocking sensitive prompts is still in preview. If most sensitive files are unlabeled, this control protects little until auto-labeling, which is E5 tier, catches up.
What Varonis Adds, and What the Proofpoint Deal Changes
Varonis adds automated remediation across the whole tenant, and it now carries ownership risk you must price in. Its product page says it "automatically remediates risky permissions at scale," calculates effective permissions and targets shared links. It also says "We capture all Copilot interactions, including prompts and responses" in a searchable audit trail. The capture alone is a weak reason to buy, because Microsoft 365 audit records already cover prompts, responses and referenced content. The stronger reasons are behavior alerts and coverage beyond Microsoft 365.
The evidence is thin. Varonis says one customer cut Copilot exposure by 99.8% in 10 days and right-sized 57,000 sensitive files with no help desk tickets. Those are vendor claims from a page last updated in March 2025, and the customer is not named. A search on November 3, 2026 found no independent benchmark. Ask for a proof of value on your own tenant, with rollback tested.
Two dates affect the contract. Varonis set the end of life of its self-hosted product for December 31, 2026, 58 days from this writing, and promises to partner with remaining customers on migration. If you run self-hosted, settle the SaaS move and your data residency position before you add Copilot scope. Then, on October 15, 2026, Proofpoint agreed to buy Varonis for $49.75 per share, about $6.3 billion, with closing expected in the first half of 2027. The companies stay separate until then, and afterward Proofpoint "intends to move quickly to integrate the companies' capabilities." Our deal coverage found no public commitment on pricing, brand or product sunsets.
So negotiate as if the product you demo may change. Ask for a price hold through renewal, an explicit change-of-control clause and a data export right at termination. If you want Varonis signals in one place, Microsoft lists it as a DSPM partner integration, alongside Cyera, BigID and OneTrust. Varonis also sells Atlas as a separate product, so check which SKU a quote covers.
Contain First, Then Remediate
Contain the riskiest sites, roll out Copilot in cohorts and remediate behind it, because a clean-everything-first project gives you no safe date to ship. Microsoft's blueprint also contains before it hardens: reduce Copilot exposure quickly, then harden, with interim restrictions "if needed."
The case against this order starts with RCD changing no permissions. An overshared file stays open to anyone with access who finds it, and a rollout can remove the pressure to finish. Clean-first also suits a bank or a hospital whose regulator will ask what was exposed on launch day. If that is you, keep Copilot in a small cohort longer and do not lift restrictions on a date. Evidence on either side is weak: the same search found only vendor and consultancy guidance, with no customer publishing failure rates for clean-first projects. Treat this sequence as judgment.
To keep containment from becoming permanent, give every RCD site an owner and an exit condition. Redmond argues that every Copilot tenant should consider RCD for sensitive and obsolete content, and that fits a short list better than a long one. Over-restriction costs you too, since Microsoft warns it can reduce the completeness of Copilot answers.
Who Should Not Buy Each Option
Each option has a buyer it will disappoint.
Skip Varonis if you have a few hundred sites, E5 and labels on most sensitive files. Your site owners and SAM reports can finish that job, and a contract signed during a pending sale adds risk for little return. That size threshold is a judgment call, so run the test below before relying on it.
Skip an E5 upgrade if permission cleanup is the only reason. Buy it when you will use auto-labeling, file DLP and insider risk controls together, and check first whether a smaller add-on covers your need.
Do not rely on SAM alone if owners are absent on most sites, you have nobody to maintain PowerShell, or sensitive data also sits in file shares and other clouds. SAM governs SharePoint and OneDrive only, and that is the clearest case for a third party.
What Predicts Regret, and What Changes the Answer
Owner completion rate predicts regret better than any feature list. Three measurements decide this purchase.
The first is review completion. Send site access reviews for 50 overshared sites and count completions after 30 days. If under half finish after one reminder, a judgment threshold rather than a benchmark, delegated cleanup will not scale at your company. The second is item volume: run the special groups report, and if it nears the 1 million row limit or your team cannot own the scripts, automation pays for itself sooner. The third is label coverage, because file DLP cannot protect what nobody labeled.
Any of these changes the answer. A failed completion test moves Varonis or a comparable tool up. Poor label coverage moves E5 auto-labeling up. A large non-Microsoft data estate moves third-party tools up regardless of the other two.
What to Do This Week, This Month and This Quarter
This Week:
- Assign your first Copilot licence if you have not, and confirm SAM features appear. Assign the SharePoint Advanced Management Administrator role, since standard admins cannot see file properties across sites they do not own.
- Run the site permissions report, then the special groups report once the first has completed.
- Apply restricted access control to payroll, M&A and board sites, and RCD to about a dozen others. Start early, because large sites can take over a week to update.
This Month:
- Send the 50-site review test and record the completion rate.
- Have a low-privilege test account prompt Copilot for salary, merger and customer terms, and keep the results as your baseline.
- Move any Restricted SharePoint Search allow-list to RCD.
Before Quarter Close:
- Script the "Everyone except external users" cleanup in waves, with a rollback list.
- Decide on Varonis or E5 from your three measurements. If Varonis wins, run the proof of value and get the change-of-control terms in writing.
- Lift RCD site by site as each one passes review.
The Bottom Line
You probably own, or are about to own, the tools that handle the first 90 days. Enterprise search rollouts ran into the same problem when better search exposed old permission mistakes, and Copilot brings it back with more users asking more questions.
Purview and Varonis solve different halves of it, and most tenants should prove the case for either one before paying. Run the 50-site review test before you take a Varonis demo or an E5 quote.
Continue Reading
- Proofpoint Agrees to Buy Varonis for $6.3B
- True Cost of a Copilot Seat: The Licence Is the Floor
- AI Bundles Push Microsoft, Google and Salesforce to Raise Prices
- Glean vs Copilot vs Dust: Buy the Permission Model
- Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
- Copilot Memory Survives Your Password Reset. Go Purge It.