How to make AI adoption succeed with Entra ID, Purview, SharePoint and OneDrive

Many organisations start AI adoption with the product question: Copilot, Claude, or both? The question comes too early. Both tools access documents, emails and chats the user can already reach. They do not bypass permissions, but they reveal what years of accumulated sharing mean.

This article describes the order in which to build the foundation in Microsoft Entra ID, SharePoint, OneDrive and Microsoft Purview so that the roll-out stands up to an audit.

Why is oversharing the real risk with Copilot and Claude?

Oversharing means content that is accessible to more people than the business requires. Typical causes are links for the whole organisation, sites with the group “Everyone except external users” as a member, broken permission inheritance and sites without an accountable owner.

Without AI, these shares rarely stand out because nobody searches for them. An AI assistant searches everything the user can access and summarises it. A salary list in a wrongly shared library then appears in an answer. The risk lies in the permissions.

Which question should the board ask before choosing an AI tool?

“Who can see what today, and do we know that reliably?” If the answer is unclear, AI adoption is first a permissions project. For the board, that means three decisions: a budget for clean-up before the roll-out, an accountable person for each data area, and a willingness to stage the roll-out instead of assigning every licence on day one.

How do you get Entra ID in order before introducing AI?

AI tools inherit every weakness in your identities. A compromised account with AI access finds sensitive content faster than an attacker without it. Three items should be done before the roll-out:

• MFA for all accounts, with phishing-resistant methods such as passkeys for administrators.
• Conditional Access, the rules that tie access to conditions such as a compliant device. AI services should not be an exception.
• Guest account review. Guests from finished projects often keep access to Teams and SharePoint sites. Recurring access reviews in Microsoft Entra ID Governance remove that access in a traceable way.

How do you find overshared content in SharePoint and OneDrive?

The tools come with SharePoint Advanced Management (SAM). Microsoft provides the SAM features mentioned here to tenants with Microsoft 365 Copilot licences; check the exact scope for your tenant.

1. Data access governance reports. In the SharePoint admin center under Reports > Data access governance, they show, among other things, sites shared with “Everyone except external users”, organisation-wide sharing links and the permission state per site.
2. Site access review. From the reports, you ask site owners to review access to their sites. This distributes the work to the people who know the content and creates a documented process.
3. Restricted Content Discovery as a bridge. For sites that take longer to clean up, Restricted Content Discovery removes the site from organisation-wide search and from Copilot responses. Permissions stay unchanged. The feature is intended as a temporary measure; it applies to SharePoint sites only, not OneDrive.

The frequently cited alternative, Restricted SharePoint Search, is being retired: since 31 July 2026 it can no longer be newly enabled, and Restricted Content Discovery takes its place. Neither feature changes permissions, so neither replaces the clean-up.

In addition, Data Security Posture Management (DSPM) in Microsoft Purview shows overshared sites with sensitive content in its data risk assessments. Microsoft now maintains “DSPM for AI” as a classic version.

What do sensitivity labels and DLP in Microsoft Purview do for Copilot?

Sensitivity labels are classifications such as “Confidential” that stay attached to documents and emails and can carry protection such as encryption. For the board, this means the classification travels with the document, and protection rules can build on it.

Two mechanisms apply to Microsoft 365 Copilot:

• Usage rights. If a label grants a user the right to view but not to extract, Copilot does not summarise the content.
• DLP for Copilot. A DLP policy for the location “Microsoft 365 Copilot and Copilot Chat” prevents Copilot from processing files and emails with specific labels when generating responses. Further rules block prompts containing sensitive information types, or block web search for such prompts. Start these policies in simulation mode.

For traceability, Microsoft Purview Audit records each Copilot interaction with the operation “CopilotInteraction”. The record shows which user asked when and in which application, and which files Copilot accessed, including the file’s label. This is included in Audit (Standard) once Copilot is licensed and in use.

How does Claude Enterprise fit into the same logic?

Claude Enterprise is connected to Microsoft Entra ID through single sign-on, with users provisioned through SCIM. Sign-in is then subject to the same Conditional Access rules as other business applications, and leavers lose access when their account is disabled.

When Claude is connected to SharePoint and OneDrive through the Microsoft 365 connector, it accesses content with the signed-in user’s permissions, so the clean-up protects here too. During the pilot, check which permissions the enterprise application requests in Entra ID, and grant consent centrally as an administrator.

Microsoft Purview supports Anthropic Claude (Enterprise) through a connector that is marked as preview (as of October 2026) and requires Purview pay-as-you-go billing. Supported capabilities include DSPM, audit, Insider Risk Management, Communication Compliance, eDiscovery and retention, but currently neither sensitivity labels nor DLP. The label-based Copilot restrictions therefore do not apply to Claude. Where Claude reaches sensitive areas, the permissions themselves must be right.

What does an auditable path from pilot to evidence pack look like?

1. Define a pilot group with people from departments whose data is well understood, and with a clear feedback channel.
2. Adopt an acceptable-use policy. It defines which tools are approved, which data does not belong in prompts and how to handle results. How to technically block other AI services is covered in our article Using Global Secure Access to control which AI tools are used in your organisation.
3. Expand step by step as soon as the site access reviews for the affected areas are complete.
4. Assemble the evidence pack. For the auditor it contains: the oversharing reports before and after clean-up, the completed site access reviews and guest access reviews, the label and DLP policies with activation dates, a sample extract from the audit log and the adopted acceptable-use policy.

The next step

AI adoption is audit-ready when every approval can be traced to who decided it and how it is monitored. Our approach is described on the AI Foundation page. If you first want to know where permissions and identities in your tenant stand, the fixed-price Gap Assessment is the right starting point.

Book an introductory call

Frequently Asked Questions

Can Microsoft 365 Copilot access documents a user has no permission for?

No. Copilot works in the security context of the signed-in user and only shows content that user can access. The risk arises when users have access to more content than the business requires. That oversharing should be cleaned up before the roll-out.

Do Purview sensitivity labels apply to Claude?

Microsoft Purview currently supports neither sensitivity labels nor DLP for Claude interactions. Audit, eDiscovery, Insider Risk Management and DSPM are available through a connector marked as preview. Protecting sensitive content in Claude therefore depends on correct permissions.

What evidence does an auditor expect for an AI roll-out?

Typically an acceptable-use policy, documented permission reviews, the active protection policies with activation dates, and proof that AI interactions are logged. SharePoint Advanced Management, Microsoft Entra ID Governance and Microsoft Purview Audit let you produce this evidence from the tenant.