Take Advantage of SharePoint Advanced Management in Your Microsoft 365 Copilot Tenant

Microsoft has quietly turned on a huge gift for Copilot customers: every tenant with Microsoft 365 Copilot licences now automatically unlocks SharePoint Advanced Management (SAM) at no extra cost.

If you’re in IT, compliance, or security, this means the governance tooling you used to justify in budget meetings is suddenly included in your Copilot SKU. Expect to see SAM toggled on in the SharePoint admin centre across the globe this week.

Below is a practical walkthrough of the SAM features you’ll want to light up first, each with a clear business benefit and a “copy-paste” set of steps you can follow today.

1. Data Access Governance (DAG)

Benefit: Instantly surface overshared sites, OneDrive, files, or anything granted to “Everyone Except External Users”. DAG reports help you prioritise permission clean-up before Copilot ingests that data.

Learn more about Data Access Governance (DAG)

How to run your first DAG reports

1. SharePoint admin centre → Reports → Data access governance. 
2. Choose a report type (EEEU, Sharing links, Sensitivity labels).
3. Select Run report; wait a few hours for generation. 
4. Download the CSV to review and remediate.
5. Optional: schedule a Site Access Review (see feature 5) straight from the report. 

2. Restricted Content Discovery (RCD)

Benefit: Hide high-risk sites from tenant-wide search, Copilot Business Chat, and AI Agents without touching user permissions or retention labels. Great for “quarantine-while-you-audit.”

Learn more about Restricted Content Discovery (RCD)

Steps

1. Admin centre → Sites → Active sites. 
2. Select a site → Settings tab. 
3. Toggle Restrict content from Microsoft 365 Copilot to On → Save. 
4. (Optional PowerShell) powershell

Set-SPOSite -Identity <siteUrl> -RestrictContentOrgWideSearch $true 

3. Restricted Access Control (RAC)

Benefit: Lock a site so only members of specified Microsoft Entra or M365 groups can open it, perfect for legal holds or M&A projects, while legitimate users keep working.

Learn more about the Restricted Access Control (RAC)

Steps

1. Admin centre → Policies → Access control → Site-level access restriction → Allow. 
2. For each site: Sites → Active sites → Select site → Settings → Restricted site access → Edit. 
3. Add up to 10 security or Microsoft 365 groups → Save.

4. Site Lifecycle Policies

Benefit: Auto-discover inactive or ownerless sites, notify owners, and (optionally) flip them read-only or archive, keeping Copilot’s index lean and compliant.

Learn more about Site Lifecycle Policies

Steps

1. Policies → Site lifecycle management → + Create policy. 
2. Define scope (all sites or CSV of URLs), inactivity threshold, and enforcement action.
3. Pick Simulation (one-off report) or Active (monthly). 
4. Name → Finish. Review reports and owner responses in the dashboard.

5. Site Access Reviews

Benefit: Crowd-source oversharing fixes: send DAG findings to site owners to validate or clean permissions, no admin deep dive required.

Learn more about the Site Access Reviews

Steps

1. Run a DAG report (Feature 1).
2. Select risky sites → Initiate site access review. 
3. Add context, send, and track status under My review requests. 

6. AI-Powered Insights

Benefit: One-click, LLM-generated recommendations on any DAG, Lifecycle, or Change History report. Saves hours of manual Excel wrestling.

Learn more about AI-Powered Insights

Steps

1. Open a completed report → Get AI insights. 
2. Review suggested actions (e.g., “apply sensitivity label”, “remove EEEU”).
3. Generate up to five insights per report for deeper patterns.

7. Block Download Policies

Benefit: Grant browser-only, no-download access at site level, including Teams meeting recordings—sans Conditional Access complexity.

Learn more about Block Download Policies

1. Admin centre → Sites → Active sites → Select site. 
2. Policies section → Block download policy → Enable. 
3. Users now see a banner: “Your organisation doesn’t allow you to download, print, or sync from this site.” 

8. Site Change History

Benefit: Create on-demand CSV reports that show who changed what across site or org settings for the past 180 days, essential for Copilot audit trails.

Learn more about the Site Change History

Steps

1. Reports → Change history → New report. 
2. Choose Site settings or Organisation settings, date range, and filters. 
3. Generate → Download CSV for evidence or rollback analysis.

Coming Soon to SAM

• Agent usage & performance insights
• Attestation policies (owners must periodically confirm permissions)
• Content Management Assessment (CMAs)
• Delegated RCD (site owners can self-apply)
• User & Group-level permission heat-maps

Your 30-Minute Action Plan

1. Open the SharePoint admin centre and confirm the SAM banner is active. 
2. Run a DAG EEEU report and schedule a Site Access Review. 
3. Enable RCD on one risky site to test Copilot scoping. 
4. Pilot a Site Lifecycle Policy on sites older than 6 months. 
5. Flip on AI Insights for the DAG report and action at least one recommendation. 

With SAM now included in your Copilot license, governance no longer has to be a blocker, it’s a built-in accelerator. From surfacing overshared content to locking down sensitive sites and generating AI-powered insights, these tools help you stay secure, compliant, and Copilot-ready.

Need deeper guidance? Microsoft’s official docs and the community’s walkthroughs are linked for each feature, or explore 2toLead’s own analysis and governance playbooks on our insights hub.

Governance doesn’t have to slow Copilot down, SAM just made it friction-free.