Check existing external shares against approved access
Compare supplied access evidence with approved recipients, files and permission levels.
Tools for the documented steps
Practice relevance
Cross-practice idea · Useful supporting administrative method; no claim of practice-specific legal instructions.
Scope: Microsoft SharePoint sharing/audit reports only; no automatic permission changes or authority determination.
The problem
Compare supplied access evidence with approved recipients, files and permission levels.
Why it matters: A file can be exposed through a broad link, inherited access or an unintended permission level. Reviewing the actual coverage and approved recipients helps IT find exceptions without treating a partial report as an all-clear.
Sources & evidence
Proposed / not tested. The public source describes the problem. Documentation supports only the stated method components; no result from this recipe has been verified.
What’s been verified
Source methods and reported problems have been reviewed. We have not run the adapted workflow. The sample below describes expected behavior on synthetic data, not a customer result.
What to measure: In a synthetic pilot, count correctly found exceptions, false alarms, and unresolved inputs. No time or cost saving is assumed.
- Pain evidence: What was your worst/most memorable paralegal mistake? ↗What was your worst/most memorable paralegal mistake?, 27 July 2023, older. An original commenter describes receiving defense counsel's ShareFile folder containing intended medical records plus internal memos and summaries, and finding the folder still accessible months later. This is firsthand recipient observation, not admission by the sending firm, and not proof of privilege. Indexed original comment read; direct retrieval failed. Document Sharing Help, 12 December 2025, older, independently documents law-firm friction around folder expiry and explicit user permissions. We do not adopt commenters' security claims as verified facts.
- Pain evidence: Document Sharing Help ↗Additional self-reported public account; no independent identity or outcome verification.
- Method: file/folder sharing report ↗Microsoft file/folder sharing report and sharing audit events. This is a SharePoint implementation option for a cross-platform pain. Crucial limit: the basic report omits Anyone links, unclicked directly emailed links and group membership details; it cannot certify all access. Use additional approved current permission snapshots/group expansions where available, otherwise report coverage gaps. Creating/expanding admin access is not part of this workflow.
- Method: sharing audit events ↗Additional official capability reference. The complete adapted recipe has not been tested.
Source checked: October 15, 2026. Pain accounts are self-reported. Documentation supports components; this adapted recipe and prompt have not been tested. We wrote these prompts. The adapted workflow hasn’t been tested.
Suggested approach
Start when: An approved disclosure folder already exists, or staff conducts a scheduled access review
- compare actual file/resource exposure, principals, roles and expiry with a lawyer-approved disclosure map
- Keep source references and report unknowns instead of filling gaps.
- The responsible reviewer checks the report before any separately approved action.
Limits and review
The assistant drafts or reports only. Check source records and review the output before a human performs any separately approved send or change. No automatic legal decision, money movement, account connection or publication is included.
Who reviews it: Lawyer confirms authorized disclosure scope; IT verifies effective inherited permissions and report completeness before any separately approved remediation. No rights changes or third-party disclosure. A basic report is insufficient for an all-clear.
What you need
Your firm-approved AI assistant · prepared files
- Existing SharePoint site-admin access for a sharing report and authorized access to inspect selected items.
- A current approved access matrix and complete intended resource/container inventory; authorized report storage folder restricted to the correct reviewers.
- Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent.
- Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab.
- Use synthetic inputs first. Keep real data in firm-approved accounts and processing, with appropriate access, confidentiality and retention controls. Aliases alone do not anonymize records. Never paste credentials, API keys or unnecessary client details.
How to use
Documentation-checked proposed route; source collection and human approval required
- SharePoint sharing CSV omits Anyone links and some unclicked links, and lists groups without their members. It is not an effective-permissions inventory.
- A partial report can identify observed exceptions, but cannot produce an all-clear. Group expansion, inherited access, anonymous links and all-resource coverage must be independently verified or remain false/unknown.
Check access and setup
- Actual account access, plan and source-data completeness have not been tested.
Run the native sharing report into an approved restricted folder
SharePoint Online · Selected site > Settings > Site usage > Shared with external users > Run report > choose location > Save
A site admin generates the report only in an already authorized folder with appropriate restricted access. When the completion email arrives, open the actual CSV. If no approved report location exists, pause rather than create a broadly visible security report. Record site, capture time and report scope.
- Expected output
- Native CSV containing Resource Path, Item Type, Permission, User Name/E-mail, User or Group Type, Link ID/Type and AccessViaLinkID where present.
- Next step
- Keep raw principal identities and paths restricted; use aliases for AI.
- Check before continuing
- The report creates a file on the site; it does not itself include anonymous links or expand group membership.
Inspect selected items for report blind spots
SharePoint / OneDrive web · Select file/folder > Details > Manage access; People, Groups and Links
For every item in the approved bounded resource set, inspect the People, Groups and Links views. Select a person to read the Access summary where available. Record observed link type and permission, including broad links; do not change any setting. Group membership and inherited access require separate authorized evidence; if not available, mark coverage incomplete.
- Expected output
- Manual access observations with resource/principal aliases, link type, permission and source reference.
- Next step
- Do not copy usable sharing tokens into the AI workbook. Use opaque link/resource IDs.
- Check before continuing
- Item-level inspection is not proof of full nested-group or site-wide effective access.
Map the observed records to the starter input
Excel and authorized staff · Separate analysis workbook > Home > Format as Table
Populate approved.csv from the actual approved resource/principal/max_permission/valid_until/approval_ref matrix. Map actual_access.csv from report/manual observations to snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. Populate contents.csv from a verified container/resource inventory, not only shared rows. Fill coverage.template.json booleans truthfully; absent verification is null/false. Put the same Coverage and approved permission ordering/link rules in visible worksheets; exact IDs must use a verified crosswalk. Create named tables for Approved, ActualAccess, Contents and Coverage. Put the policy and review scope in visible worksheets or paste them into the next prompt.
- Expected output
- Approved, ActualAccess, Contents and Coverage; incomplete effective-access evidence explicitly retained.
- Next step
- Check the mapping against each original source before using AI.
- Check before continuing
- Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero.
Review the bounded evidence with Copilot
Excel Copilot, optional · Approved analysis workbook > Copilot icon at lower right > Chat only
Use Chat only and submit the prompt. Without Copilot: compare actual observed grants to the approved matrix, retaining every coverage limitation.
- Expected output
- Observed access exceptions and explicit unresolved effective-access coverage.
- Next step
- Copy the draft exception list to the reviewer; retain row references.
- Check before continuing
- Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits.
Approve the review result
Final human reviewResponsible staff reviewer · Reviewed local worksheet
The authorized security/site owner verifies exceptions and missing group/inheritance/anonymous-link evidence. Any permission change is separately approved for the exact resource and principals.
- Expected output
- Reviewed security findings with coverage limitations, never an unsupported all-clear.
- Next step
- Any external message, source change, payment or deletion requires its own authorized process.
- Check before continuing
- A clean partial CSV cannot certify that a folder is private or that every user’s effective access is known.
What you’ll get
access-review.csv: resource_id, principal_id, actual_permission, approved_permission, exception, source_ref, approval_ref; coverage_summary with every supplied coverage flag and review_status. Use partial_review_no_all_clear unless every coverage flag is verified true. Even complete supplied coverage does not establish confidentiality or privilege. Derive every finding from the supplied snapshots and approvals.
Inputs and a sample test Synthetic example · not a measured result
Input files
- approved.csv = resource_id,principal_id,max_permission,valid_until,approval_ref. actual_access.csv = snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. contents.csv = container_id,resource_id. coverage.json = {snapshot_at,includes_anonymous_links,groups_expanded,inheritance_resolved,all_resources_in_scope}. permission enum=view|edit; link_type=direct|specific_people|organization|anyone|group. Missing information is unknown, not false.
Synthetic example
Synthetic inputs are included in the starter kit. approved.example.csv actual_access.example.csv contents.example.csv coverage.example.json
Expected output
R1/P1 edit exceeds approved view. R2/P1 is unapproved resource exposure. R1/ANONYMOUS is a broad Anyone-link exception and unmatched principal. includes_anonymous_links=false means anonymous coverage is incomplete even though one known Anyone row is present.
Test a failure
Lawyer confirms authorized disclosure scope; IT verifies effective inherited permissions and report completeness before any separately approved remediation. No rights changes or third-party disclosure. A basic report is insufficient for an all-clear.
Try with the sample files
Follow the tool steps above and use the inputs named in each step. Where provided, native-* files are blank scaffolds and NATIVE-INPUT-MAPPING explains their fields. Original examples and the optional full review prompt use a separate prepared-input schema. Keep them separate unless the mapping explicitly connects them. Downloading a kit does not connect accounts or prove the workflow works.
Download inputs and checklist 12 files
Instructions, blank templates and separate synthetic examples; these files do not install an automation. Blank templates still need verified source data.
- Download starter kit All inputs, synthetic examples and review notes in one ZIP. No automation is installed.
- Start here: get the sources and prepare the review Documentation-checked acquisition, explicit manual mapping, exact prompts and human review limits
- approved blank template Approved recipients, resources, maximum access and validity
- approved synthetic example Approved recipients, resources, maximum access and validity
- actual_access blank template Read-only effective-access snapshot, including visible broad links
- actual_access synthetic example Read-only effective-access snapshot, including visible broad links
- contents blank template Explicit folder-to-resource expansion
- contents synthetic example Explicit folder-to-resource expansion
- coverage blank input Preserve nested input structure and validate supplied field types
- coverage synthetic fixture Preserve nested input structure and validate supplied field types
- coverage JSON Schema Preserve nested input structure and validate supplied field types
- Setup and fixture review guide Recipe-specific setup, input rules, offline prompt, expected result and boundaries
Optional full review prompt for prepared inputs
Prepared-input review prompt with Your firm-approved AI assistant · prepared files
Proposed / not tested · editorial prompt. This prompt uses the original prepared-input schema shown in the sample test. Step prompts may use different tables. Follow NATIVE-INPUT-MAPPING where supplied; do not mix the original examples with native-step inputs without mapping and checking every field.