Data exposure

Copilot and other AI tools answer each person from everything that person can open. A file shared with an Anyone link or with Everyone is a file AI can bring to anyone. The Data exposure section finds that sharing before it becomes a problem, and is the biggest part of the AI readiness score (30% by default).

Open the customer, go to AI readiness and choose Data exposure.

What the scan reads#

Tenvara reads every SharePoint site, Teams site, document library and OneDrive in the customer's tenant and keeps the files and folders that have sharing of their own. Everything inside a shared folder counts as part of that folder's exposure, so the list stays short enough to act on.

For each shared item it records how far the sharing reaches (anyone, everyone, the whole organisation, guests or named people), whether the wide sharing lets people edit, and which guests can reach it. It also reads each site's owners and whether they are still here, when the site was last used, and the tenant's sharing settings. Later scans only read what changed.

When it runs#

• Every day for customers that have been assessed, by default. Change it in Settings > AI readiness with Read sharing every.
• A full read of everything again every 30 days (Read everything again every).
• Before an assessment, when the last scan is older than that.
• When you press Scan now on the page. Its menu offers changes only or everything again.

The line under the description says when it last read and what it found.

The counts#

The tiles across the top each open the links table filtered to that kind of sharing:

Below them, Findings, Links, Sites and Guests switch between the findings and the evidence tables. The links table lists every link, widest first, with its reach, whether it can edit and its site. The sites table shows sharing, stale sites and owners who have left. The guests table shows what each guest can reach.

Note: File, site and people names need the See evidence permission. Without it, people see the counts and the findings but not the names.

The checks#

Findings are one per link, site, group or guest, so you can fix them one at a time or select many.

Fixing exposure#

Every fix goes through the customer's approver. Nothing changes in the tenant until they say yes, and every fix that Microsoft allows can be undone.

1. In Findings, tick the findings you want to fix.
2. Press Fix with approval.
3. Read what will happen. The dialog lists every item, what the fix does and anything that cannot be put back exactly.
4. Add a reason in Why (the approver sees it).
5. Press Send for approval.

The fixes on offer:

Warning: Microsoft never gives a removed link back with the same address. Undo makes a new link, so anyone who had the old address needs the new one.

Findings such as the tenant's sharing policy or ownerless sites are the customer's decision and say By hand.

What happens to a fix after it is asked for, and how to undo it, is in Fixes, reports and the portal.

Settings#

In Settings > AI readiness under Data exposure:

• Read sharing every: hours between scans (24 by default).
• Read everything again every: days between full reads (30 by default).
• A site is stale after: days unused (180 by default). A customer can have its own.

New critical or high exposure found by an assessment raises an alert when Alert on new exposure is on. Alerts give counts, never file or people names.