# Check existing external shares against approved access Canonical page: https://agents.paretoid.com/workflows/check-existing-external-shares-against-approved-access/ Category: Operations & Reporting Practice relevance: cross-practice. Useful supporting administrative method; no claim of practice-specific legal instructions. Jurisdiction/provider scope: Microsoft SharePoint sharing/audit reports only; no automatic permission changes or authority determination. Compare supplied access evidence with approved recipients, files and permission levels. Status: Proposed / not tested. The public source describes the problem. Documentation supports only the stated method components; no result from this recipe has been verified. Verification: Source methods and reported problems have been reviewed. We have not run the adapted workflow. The sample below describes expected behavior on synthetic data, not a customer result. ## The problem Compare supplied access evidence with approved recipients, files and permission levels. Why it matters: A file can be exposed through a broad link, inherited access or an unintended permission level. Reviewing the actual coverage and approved recipients helps IT find exceptions without treating a partial report as an all-clear. ## Sources and evidence - pain: [Pain evidence: What was your worst/most memorable paralegal mistake?](https://www.reddit.com/r/paralegal/comments/15aounw) What was your worst/most memorable paralegal mistake?, 27 July 2023, older. An original commenter describes receiving defense counsel's ShareFile folder containing intended medical records plus internal memos and summaries, and finding the folder still accessible months later. This is firsthand recipient observation, not admission by the sending firm, and not proof of privilege. Indexed original comment read; direct retrieval failed. Document Sharing Help, 12 December 2025, older, independently documents law-firm friction around folder expiry and explicit user permissions. We do not adopt commenters' security claims as verified facts. - pain: [Pain evidence: Document Sharing Help](https://www.reddit.com/r/paralegal/comments/1pl0b02/document_sharing_help/) Additional self-reported public account; no independent identity or outcome verification. - method: [Method: file/folder sharing report](https://learn.microsoft.com/en-us/sharepoint/sharing-reports) Microsoft file/folder sharing report and sharing audit events. This is a SharePoint implementation option for a cross-platform pain. Crucial limit: the basic report omits Anyone links, unclicked directly emailed links and group membership details; it cannot certify all access. Use additional approved current permission snapshots/group expansions where available, otherwise report coverage gaps. Creating/expanding admin access is not part of this workflow. - method: [Method: sharing audit events](https://learn.microsoft.com/en-us/purview/audit-log-sharing?tabs=microsoft-purview-portal) Additional official capability reference. The complete adapted recipe has not been tested. Source checked: October 15, 2026. Pain accounts are self-reported. Documentation supports components; this adapted recipe and prompt have not been tested. ## Suggested approach Start when: An approved disclosure folder already exists, or staff conducts a scheduled access review 1. compare actual file/resource exposure, principals, roles and expiry with a lawyer-approved disclosure map 2. Keep source references and report unknowns instead of filling gaps. 3. The responsible reviewer checks the report before any separately approved action. ## What you need - Existing SharePoint site-admin access for a sharing report and authorized access to inspect selected items. - A current approved access matrix and complete intended resource/container inventory; authorized report storage folder restricted to the correct reviewers. - Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent. - Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab. - Use synthetic inputs first. Keep real data in firm-approved accounts and processing, with appropriate access, confidentiality and retention controls. Aliases alone do not anonymize records. Never paste credentials, API keys or unnecessary client details. ## How to use Documentation-checked proposed route; source collection and human approval required - SharePoint sharing CSV omits Anyone links and some unclicked links, and lists groups without their members. It is not an effective-permissions inventory. - A partial report can identify observed exceptions, but cannot produce an all-clear. Group expansion, inherited access, anonymous links and all-resource coverage must be independently verified or remain false/unknown. Access and setup: - Actual account access, plan and source-data completeness have not been tested. ### 1. Run the native sharing report into an approved restricted folder Tool: SharePoint Online Location: Selected site > Settings > Site usage > Shared with external users > Run report > choose location > Save A site admin generates the report only in an already authorized folder with appropriate restricted access. When the completion email arrives, open the actual CSV. If no approved report location exists, pause rather than create a broadly visible security report. Record site, capture time and report scope. Expected output: Native CSV containing Resource Path, Item Type, Permission, User Name/E-mail, User or Group Type, Link ID/Type and AccessViaLinkID where present. Next step: Keep raw principal identities and paths restricted; use aliases for AI. Check before continuing: The report creates a file on the site; it does not itself include anonymous links or expand group membership. Execution status: Official documentation checked 2026-10-15; account and workflow not personally tested Step documentation: https://learn.microsoft.com/en-us/sharepoint/sharing-reports ### 2. Inspect selected items for report blind spots Tool: SharePoint / OneDrive web Location: Select file/folder > Details > Manage access; People, Groups and Links For every item in the approved bounded resource set, inspect the People, Groups and Links views. Select a person to read the Access summary where available. Record observed link type and permission, including broad links; do not change any setting. Group membership and inherited access require separate authorized evidence; if not available, mark coverage incomplete. Expected output: Manual access observations with resource/principal aliases, link type, permission and source reference. Next step: Do not copy usable sharing tokens into the AI workbook. Use opaque link/resource IDs. Check before continuing: Item-level inspection is not proof of full nested-group or site-wide effective access. Execution status: Official documentation checked 2026-10-15; account and workflow not personally tested Step documentation: https://support.microsoft.com/en-us/sharepoint/lists/sharepoint-sharing-and-permissions/external-or-guest-sharing-in-onedrive-sharepoint-and-lists https://support.microsoft.com/en-us/sharepoint/sharepoint-sharing-and-permissions/see-who-a-file-is-shared-with-in-onedrive-or-sharepoint ### 3. Map the observed records to the starter input Tool: Excel and authorized staff Location: Separate analysis workbook > Home > Format as Table Populate approved.csv from the actual approved resource/principal/max_permission/valid_until/approval_ref matrix. Map actual_access.csv from report/manual observations to snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. Populate contents.csv from a verified container/resource inventory, not only shared rows. Fill coverage.template.json booleans truthfully; absent verification is null/false. Put the same Coverage and approved permission ordering/link rules in visible worksheets; exact IDs must use a verified crosswalk. Create named tables for Approved, ActualAccess, Contents and Coverage. Put the policy and review scope in visible worksheets or paste them into the next prompt. Expected output: Approved, ActualAccess, Contents and Coverage; incomplete effective-access evidence explicitly retained. Next step: Check the mapping against each original source before using AI. Check before continuing: Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero. Execution status: Official documentation checked 2026-10-15; account and workflow not personally tested Step documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model ### 4. Review the bounded evidence with Copilot Tool: Excel Copilot, optional Location: Approved analysis workbook > Copilot icon at lower right > Chat only Use Chat only and submit the prompt. Without Copilot: compare actual observed grants to the approved matrix, retaining every coverage limitation. Prompt: ```text Compare observed ActualAccess to Approved, Contents and Coverage at the supplied cutoff. Flag observed excess/expired/unapproved access and broad links using the supplied permission policy. Cite exact snapshot/resource/principal/source refs. Do not assume groups have been expanded or inherited access resolved. If any coverage flag is false or unknown, prominently return partial_review_no_all_clear; still list observed exceptions. Never infer no access from an absent row, disclose usable share links, change permissions or notify users. ``` Expected output: Observed access exceptions and explicit unresolved effective-access coverage. Next step: Copy the draft exception list to the reviewer; retain row references. Check before continuing: Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits. Execution status: Official documentation checked 2026-10-15; account and workflow not personally tested Step documentation: https://support.microsoft.com/en-us/excel/copilot/get-started-with-copilot-in-excel https://support.microsoft.com/en-us/excel/copilot/frequently-asked-questions-about-copilot-in-excel ### 5. Approve the review result Tool: Responsible staff reviewer Location: Reviewed local worksheet The authorized security/site owner verifies exceptions and missing group/inheritance/anonymous-link evidence. Any permission change is separately approved for the exact resource and principals. Expected output: Reviewed security findings with coverage limitations, never an unsupported all-clear. Next step: Any external message, source change, payment or deletion requires its own authorized process. Check before continuing: A clean partial CSV cannot certify that a folder is private or that every user’s effective access is known. Execution status: Official documentation checked 2026-10-15; account and workflow not personally tested Step documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model ## What you will get access-review.csv: resource_id, principal_id, actual_permission, approved_permission, exception, source_ref, approval_ref; coverage_summary with every supplied coverage flag and review_status. Use partial_review_no_all_clear unless every coverage flag is verified true. Even complete supplied coverage does not establish confidentiality or privilege. Derive every finding from the supplied snapshots and approvals. ## Human review and limits Lawyer confirms authorized disclosure scope; IT verifies effective inherited permissions and report completeness before any separately approved remediation. No rights changes or third-party disclosure. A basic report is insufficient for an all-clear. The assistant drafts or reports only. Check source records and review the output before a human performs any separately approved send or change. No automatic legal decision, money movement, account connection or publication is included. What to measure: In a synthetic pilot, count correctly found exceptions, false alarms, and unresolved inputs. No time or cost saving is assumed. ## Original prepared-input schema approved.csv = resource_id,principal_id,max_permission,valid_until,approval_ref. actual_access.csv = snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. contents.csv = container_id,resource_id. coverage.json = {snapshot_at,includes_anonymous_links,groups_expanded,inheritance_resolved,all_resources_in_scope}. permission enum=view|edit; link_type=direct|specific_people|organization|anyone|group. Missing information is unknown, not false. Synthetic example input: ```text Synthetic inputs are included in the starter kit. approved.example.csv actual_access.example.csv contents.example.csv coverage.example.json ``` Expected synthetic output: ```text R1/P1 edit exceeds approved view. R2/P1 is unapproved resource exposure. R1/ANONYMOUS is a broad Anyone-link exception and unmatched principal. includes_anonymous_links=false means anonymous coverage is incomplete even though one known Anyone row is present. ``` Failure check: Lawyer confirms authorized disclosure scope; IT verifies effective inherited permissions and report completeness before any separately approved remediation. No rights changes or third-party disclosure. A basic report is insufficient for an all-clear. ## Starter files Native blank scaffolds and original synthetic examples may use different schemas. Follow NATIVE-INPUT-MAPPING where supplied. These files do not connect accounts or install automation. - [Download starter kit](https://agents.paretoid.com/assets/starter-kits/q07-starter-kit.zip) — All inputs, synthetic examples and review notes in one ZIP. No automation is installed. - [Start here: get the sources and prepare the review](https://agents.paretoid.com/assets/starter-kits/q07/START-HERE.txt) — Documentation-checked acquisition, explicit manual mapping, exact prompts and human review limits - [approved blank template](https://agents.paretoid.com/assets/starter-kits/q07/approved.template.csv) — Approved recipients, resources, maximum access and validity - [approved synthetic example](https://agents.paretoid.com/assets/starter-kits/q07/approved.example.csv) — Approved recipients, resources, maximum access and validity - [actual_access blank template](https://agents.paretoid.com/assets/starter-kits/q07/actual_access.template.csv) — Read-only effective-access snapshot, including visible broad links - [actual_access synthetic example](https://agents.paretoid.com/assets/starter-kits/q07/actual_access.example.csv) — Read-only effective-access snapshot, including visible broad links - [contents blank template](https://agents.paretoid.com/assets/starter-kits/q07/contents.template.csv) — Explicit folder-to-resource expansion - [contents synthetic example](https://agents.paretoid.com/assets/starter-kits/q07/contents.example.csv) — Explicit folder-to-resource expansion - [coverage blank input](https://agents.paretoid.com/assets/starter-kits/q07/coverage.template.json) — Preserve nested input structure and validate supplied field types - [coverage synthetic fixture](https://agents.paretoid.com/assets/starter-kits/q07/coverage.example.json) — Preserve nested input structure and validate supplied field types - [coverage JSON Schema](https://agents.paretoid.com/assets/starter-kits/q07/coverage.schema.json) — Preserve nested input structure and validate supplied field types - [Setup and fixture review guide](https://agents.paretoid.com/assets/starter-kits/q07/README.txt) — Recipe-specific setup, input rules, offline prompt, expected result and boundaries ## Optional original prepared-input prompt Destination: Your firm-approved AI assistant · prepared files This original prompt uses its own prepared-input schema. Do not mix it with native-step tables without the supplied mapping. ```text Audit these synthetic snapshots against approved.csv. Evaluate supplied effective access only. Flag resources or principals absent from approval, edit where only view is approved, expired approvals, broad links and unresolved inherited/group access. Expand folder scope only using contents.csv; do not invent missing membership. Return resource_id,principal_id,actual_permission,approved_permission,exception,source_ref,approval_ref plus all coverage gaps. Return partial_review_no_all_clear unless every coverage flag is verified true; a missing flag is unknown, never true. Do not label anyone malicious, determine privilege, follow links, grant/revoke access, change expiry, send files or claim complete confidentiality. INPUTS approved.csv = resource_id,principal_id,max_permission,valid_until,approval_ref. actual_access.csv = snapshot_id,resource_id,principal_id,permission,link_type,inherited_from,observed_at,source_ref. contents.csv = container_id,resource_id. coverage.json = {snapshot_at,includes_anonymous_links,groups_expanded,inheritance_resolved,all_resources_in_scope}. permission enum=view|edit; link_type=direct|specific_people|organization|anyone|group. Missing information is unknown, not false. OUTPUT access-review.csv: resource_id, principal_id, actual_permission, approved_permission, exception, source_ref, approval_ref; coverage_summary with every supplied coverage flag and review_status. Use partial_review_no_all_clear unless every coverage flag is verified true. Even complete supplied coverage does not establish confidentiality or privilege. Derive every finding from the supplied snapshots and approvals. Use only these synthetic or firm-approved inputs and preserve source row/page IDs. Keep missing or conflicting evidence unresolved. Return a draft for the named reviewer. Do not send messages, connect accounts, change records or permissions, move money, or make legal decisions. Keep source files unchanged. List missing prerequisites before continuing. ``` Proposed / not tested · editorial prompt Published by Law Firm Agents. Proposed adaptation; not tested. Not legal advice.