"Copilot has its own controls."
Restricted search and tenant-wide switches blunt the symptom for everyone. ShareCare finds and fixes the specific over-shared items, and does it across every client you manage.
Data access governance
See what Copilot can reach in your tenants, and reduce it.
ShareCare answers the question every Microsoft 365 customer suddenly has to answer: what is shared with the outside world — or over-shared internally so Copilot can reach it — and who can fix it?
Why it matters now
Copilot can summarise, surface and cite anything a user can technically reach. Sharing links created years ago, "Everyone" groups and inherited permissions that never mattered now decide what an AI assistant will hand to the wrong person. Security teams are being asked — often for the first time — to show how widely data is exposed before the rollout, and keep reducing it afterwards.
Underneath that, the classic problems have not gone anywhere: anonymous link sprawl, stale guest access, and mailbox forwarding rules used for exfiltration. Native tooling reports these thinly, one workload at a time, one tenant at a time.
What it does
- Crawls seven Microsoft 365 workloads app-only — SharePoint, OneDrive, Teams, Entra app consents, Exchange forwarding, Power Platform and Power BI. No agent, no user disruption.
- Finds internal over-exposure — organisation-wide sharing links and whole-company groups such as "Everyone except external users". These are exactly the patterns that make Copilot surface data far more broadly than anyone intended.
- Scores real risk as sensitivity × exposure × reach rather than a flat checklist, and keeps an identity-level score so one risky guest account shows up on every share it can reach.
- Detects the dangerous specifics — anonymous edit links, dormant external guests measured by actual sign-in activity, over-permissioned OAuth applications, and mail forwarding to domains nobody owns.
- Remediates durably — simulate, then execute after an optional grace window, with undo and retry. App-only permission revoke on OneDrive, plus downgrade and resource-level revoke-all.
- Recertifies with the owner, not just the admin — and the owner's decision actually executes rather than landing in a report.
- Benchmarks the fleet — rank and compare oversharing exposure across every managed tenant.
What it does not do yet
Some workloads are read-only today: Exchange forwarding rules, SharePoint site roles, Power Platform and delegated-admin relationships are detected but not revoked app-only. When ShareCare cannot safely act, it tells you the precise reason instead of guessing or silently skipping.
OneDrive permission revoke and sharing-link revoke are live today. Beyond Microsoft 365, Box public links and external collaborations are covered with app-only revoke, and Slack Connect externally-shared channels are read-only pending the admin APIs that would let us act.
Inside ShareCare
What’s in the product
The screens you will actually work in.
What a finding actually looks like
Not a CSV of everything. A scored item, the reasons behind the score, the root cause, and the action — with the alternative to remediating stated next to it.
No number you cannot take apart
A score you have to trust is a score you will argue with. Every one on this screen opens into the reasons that produced it, and every reason names something you can change.
- The arithmetic, in the open. Edit access +25, no expiry +10, freemail domain +10. Change any one of those and the score moves — you can see in advance by how much.
- A cause, then a fix. Not “this file is risky” but who was granted what, directly on which resource, and the one action that ends it.
- Accepting the risk is a real answer. Some sharing is the business working. Accept it and it stops nagging — but it stays on the record, with your name on the decision.
- Not licensed. The workload exists in your tenant but nothing here can reach it. It is excluded from the score rather than counted as clean.
- Not connected. Same again for anything outside Microsoft 365. A workload nobody scanned is never counted as a pass.
Capability and what you get from it
| Capability | What it means for you |
|---|---|
| Cross-workload sharing and permission crawl | One picture of exposure instead of seven separate workload reports |
| Org-wide link and "Everyone" group detection | A direct answer to "what can Copilot reach?" |
| Sensitivity × exposure risk model | Prioritise the shares that actually matter, not the loudest ones |
| Durable remediation with grace window and undo | Fix safely in production, and reverse a mistake |
| Owner-delegated recertification | Push the decision to the person who owns the data |
| Fleet benchmarking | Rank clients by exposure and drive the remediation conversation |
ShareCare pricing
Prices on the site. All of them.
Per Microsoft 365 user, per month. No seat minimum and no platform floor — a twelve-person company pays for twelve people — and scans are never metered.
Step 1 · See it
Visibility
€2 /user/mo
- Read-only inventory of sharing and permissions
- Risk scoring and findings history
- Fleet view
- Daily scheduled scans
Step 2 · Govern it
Governance
€4 /user/mo
- Everything in Visibility
- Oversharing and advanced detections
- Policies, access reviews and approvals
- Waivers and evidence packs
- Six-hourly scans
Step 3 · Act on it
Automation
€6.50 /user/mo
- Everything in Governance
- Hourly scans
- OneDrive permission and sharing-link write-back, with undo
- Requires a separate connector remediation consent
Volume discount on the whole bill 10% above 100 users 20% above 500 30% above 2,000 Worked bills and every product’s pricing
Common questions
"Will scanning disrupt users?"
The crawl is app-only, and a scan only reads. Remediation is simulate-then-execute with a grace window and undo, and it only runs on the tier you bought.
"We only need this once, before Copilot."
Sharing sprawl regenerates continuously — new links, new guests, new apps. And the continuous version is what becomes compliance evidence.
"Can it fix Exchange forwarding rules?"
It detects them. App-only revoke for that workload needs Exchange PowerShell and is on the roadmap.
"Microsoft already gives us SharePoint Advanced Management."
For one tenant administered as an ongoing discipline, it and the governance specialists are a reasonable buy. Where ShareCare differs is across many small tenants, and in keeping the record as evidence. How the two compare.
Running this across client tenants? Fleet view and benchmarking across your book, delegated onboarding with an optional client approval gate, pooled capacity and partner margin.
See the provider modelStart with a Copilot-readiness assessment
A real crawl of your worst tenants, a scored exposure report, and a remediation plan — whether or not you buy anything afterwards.