Audit existing external-share access against approved recipients and files Get the source data and prepare the review Documentation-checked proposed route; source collection and human approval required WHAT WAS CHECKED Official documentation checked; all routes are proposed and have not been run in a product account. No client data, account access, installs or account writes used. Native column names are distinguished from editorial kit contracts. Missing source evidence blocks completeness claims. BEFORE YOU START - Existing SharePoint site-admin access for a sharing report and authorized access to inspect selected items. - A current approved access matrix and complete intended resource/container inventory; authorized report storage folder restricted to the correct reviewers. - Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent. - Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab. DATA ACQUISITION LIMITS - SharePoint sharing CSV omits Anyone links and some unclicked links, and lists groups without their members. It is not an effective-permissions inventory. - A partial report can identify observed exceptions, but cannot produce an all-clear. Group expansion, inherited access, anonymous links and all-resource coverage must be independently verified or remain false/unknown. DECLARED INPUT CONTRACT approved.csv: resource_id, principal_id, max_permission, valid_until, approval_ref actual_access.csv: snapshot_id, resource_id, principal_id, permission, link_type, inherited_from, observed_at, source_ref contents.csv: container_id, resource_id coverage.json STEP 1: Run the native sharing report into an approved restricted folder Tool: SharePoint Online Open: Selected site > Settings > Site usage > Shared with external users > Run report > choose location > Save Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. A site admin generates the report only in an already authorized folder with appropriate restricted access. When the completion email arrives, open the actual CSV. If no approved report location exists, pause rather than create a broadly visible security report. Record site, capture time and report scope. Expected output: Native CSV containing Resource Path, Item Type, Permission, User Name/E-mail, User or Group Type, Link ID/Type and AccessViaLinkID where present. Use it next: Keep raw principal identities and paths restricted; use aliases for AI. Check: The report creates a file on the site; it does not itself include anonymous links or expand group membership. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://learn.microsoft.com/en-us/sharepoint/sharing-reports STEP 2: Inspect selected items for report blind spots Tool: SharePoint / OneDrive web Open: Select file/folder > Details > Manage access; People, Groups and Links Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. For every item in the approved bounded resource set, inspect the People, Groups and Links views. Select a person to read the Access summary where available. Record observed link type and permission, including broad links; do not change any setting. Group membership and inherited access require separate authorized evidence; if not available, mark coverage incomplete. Expected output: Manual access observations with resource/principal aliases, link type, permission and source reference. Use it next: Do not copy usable sharing tokens into the AI workbook. Use opaque link/resource IDs. Check: Item-level inspection is not proof of full nested-group or site-wide effective access. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://support.microsoft.com/en-us/sharepoint/lists/sharepoint-sharing-and-permissions/external-or-guest-sharing-in-onedrive-sharepoint-and-lists https://support.microsoft.com/en-us/sharepoint/sharepoint-sharing-and-permissions/see-who-a-file-is-shared-with-in-onedrive-or-sharepoint STEP 3: Map the observed records to the starter input Tool: Excel and authorized staff Open: Separate analysis workbook > Home > Format as Table Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. Populate approved.csv from the actual approved resource/principal/max_permission/valid_until/approval_ref matrix. Map actual_access.csv from report/manual observations to snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. Populate contents.csv from a verified container/resource inventory, not only shared rows. Fill coverage.template.json booleans truthfully; absent verification is null/false. Put the same Coverage and approved permission ordering/link rules in visible worksheets; exact IDs must use a verified crosswalk. Create named tables for Approved, ActualAccess, Contents and Coverage. Put the policy and review scope in visible worksheets or paste them into the next prompt. Expected output: Approved, ActualAccess, Contents and Coverage; incomplete effective-access evidence explicitly retained. Use it next: Check the mapping against each original source before using AI. Check: Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model STEP 4: Review the bounded evidence with Copilot Tool: Excel Copilot, optional Open: Approved analysis workbook > Copilot icon at lower right > Chat only Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. Use Chat only and submit the prompt. Without Copilot: compare actual observed grants to the approved matrix, retaining every coverage limitation. PASTE THIS PROMPT Compare observed ActualAccess to Approved, Contents and Coverage at the supplied cutoff. Flag observed excess/expired/unapproved access and broad links using the supplied permission policy. Cite exact snapshot/resource/principal/source refs. Do not assume groups have been expanded or inherited access resolved. If any coverage flag is false or unknown, prominently return partial_review_no_all_clear; still list observed exceptions. Never infer no access from an absent row, disclose usable share links, change permissions or notify users. Expected output: Observed access exceptions and explicit unresolved effective-access coverage. Use it next: Copy the draft exception list to the reviewer; retain row references. Check: Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://support.microsoft.com/en-us/excel/copilot/get-started-with-copilot-in-excel https://support.microsoft.com/en-us/excel/copilot/frequently-asked-questions-about-copilot-in-excel STEP 5: Approve the review result Tool: Responsible staff reviewer Open: Reviewed local worksheet Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. The authorized security/site owner verifies exceptions and missing group/inheritance/anonymous-link evidence. Any permission change is separately approved for the exact resource and principals. Expected output: Reviewed security findings with coverage limitations, never an unsupported all-clear. Use it next: Any external message, source change, payment or deletion requires its own authorized process. Check: A clean partial CSV cannot certify that a folder is private or that every user’s effective access is known. Documentation limit: Editorial human-review gate; linked Excel documentation supports the worksheet used, not legal or accounting conclusions. Source documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model ACCOUNT AND SOURCE CHECKS STILL NEEDED - Actual account access, plan and source-data completeness have not been tested. USING THE FILES IN THIS KIT Use the exact files or source text named in the steps above. Native exports keep their own headers. The kit tables are editorial review worksheets; they are not a claim that a product exports those fields. Some routes use reviewed text directly or require additional original files. Never rename an unreviewed raw export to make it appear mapped. Keep expected-result files separate from inputs. The source account, actual data, prompts and end-to-end workflow were not tested. Any final communication, filing, permission change, payment or publication needs its own authorized human action. This guide performs none.