Product area
Access & sharing
Who can reach what: permissions, guests, external access and sharing.
97 pages · All tags
Guides 5
Concepts 1
Use cases 6
- Use cases › What do you want to do?Clean up after leavers
Find what people who left still own or hold, such as Teams, sites, OneDrives and licenses, and hand it over or remove it.
- Use cases › What do you want to do?Find and fix oversharing
Find files, sites and Teams that are shared more widely than they should be, and remove the sharing or ask the owners to clean it up.
- Use cases › What do you want to do?Govern guests and external users
See every guest in your tenant, find the ones who are inactive or never accepted their invitation, and remove their access.
- Use cases › What do you want to do?Govern Power Platform and Power BI
Know every Power App, flow and Power BI workspace, and find the ones without owners, the unused ones and the ones shared too widely.
- Use cases › What do you want to do?Prepare your content for Copilot
Before you roll out Copilot, find the sites and files that are shared too widely, have no sensitivity label, or are old and unused.
- Use cases › What do you want to do?Recertify access with reviews
Ask workspace owners on a schedule to confirm who still needs access, and remove the people who do not.
Reference 76
- Reference › Policies › Microsoft 365Administrators without MFA
Shows administrators that have not activated multi factor authentication. Built-in Microsoft 365 policy "Administrators without MFA".
- Reference › Policies › ChatGPT EnterpriseAgent runs without a human and reaches external systems
What the built-in ChatGPT Enterprise policy "Agent runs without a human and reaches external systems" in Rencore Governance detects, and the rule behind it.
- Reference › ConnectorsChatGPT Enterprise
What Rencore Governance covers for ChatGPT Enterprise: 33 object types, 30 policies, 18 automations and 9 built-in actions, grouped by product area.
- Reference › Policies › ChatGPT EnterpriseChatGPT login bypassed SSO
Detects users who signed in with a password rather than through the identity provider in the last 30 days. The "ChatGPT login bypassed SSO" policy.
- Reference › Policies › ChatGPT EnterpriseChatGPT user with no Entra ID identity
Detects ChatGPT users who do not match any Entra ID user by email. Built-in ChatGPT Enterprise policy "ChatGPT user with no Entra ID identity".
- Reference › Policies › ChatGPT EnterpriseChatGPT workspace with too many admins
Detects workspaces where more than five users hold the admin role. Built-in ChatGPT Enterprise policy "ChatGPT workspace with too many admins".
- Reference › Policies › Claude EnterpriseClaude Code user is disabled in Entra ID
Detects Claude users which have been disabled in Entra ID and should be removed. Built-in Claude Enterprise policy "Claude Code user is disabled in Entra ID".
- Reference › ConnectorsClaude Enterprise
What Rencore Governance covers for Claude Enterprise: 21 object types, 17 policies, 2 automations and 1 built-in action, grouped by product area.
- Reference › Policies › Claude EnterpriseClaude organization with not enough admins
Detects organizations with only 1 or less admin. Built-in Claude Enterprise policy "Claude organization with not enough admins".
- Reference › Policies › Claude EnterpriseClaude organization with too many admins
Detects organizations where too many users are admins. Built-in Claude Enterprise policy "Claude organization with too many admins".
- Reference › Policies › Claude EnterpriseClaude user is not member of Entra ID
Detects users in Claude organizations which are not part of Entra ID. Built-in Claude Enterprise policy "Claude user is not member of Entra ID".
- Reference › Policies › Claude EnterpriseCode artifact publicly readable
Detects Code artifacts whose read mode makes them readable by anyone on the internet. Built-in Claude Enterprise policy "Code artifact publicly readable".
- Reference › Policies › Copilot StudioConfidential site referenced in Copilot agent
What the built-in Copilot Studio policy "Confidential site referenced in Copilot agent" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Claude EnterpriseConnector performs write actions
What the built-in Claude Enterprise policy "Connector performs write actions" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Claude EnterpriseConnector used with a personal login
What the built-in Claude Enterprise policy "Connector used with a personal login" in Rencore Governance detects, and the rule behind it.
- Reference › ConnectorsCopilot
What Rencore Governance covers for Copilot: 5 object types and 5 policies, grouped by product area.
- Reference › ConnectorsCopilot Studio
What Rencore Governance covers for Copilot Studio: 12 object types and 10 policies, grouped by product area.
- Reference › Policies › ChatGPT EnterpriseCustom GPT calls an external domain without authentication
Detects custom actions that call an external host with no authentication configured. The "Custom GPT calls an external domain without authentication" policy.
- Reference › Policies › Entra IDEnterprise applications that use Microsoft Graph permissions
Shows Entra ID apps that use Microsoft Graph permissions. Built-in Entra ID policy "Enterprise applications that use Microsoft Graph permissions".
- Reference › Policies › Entra IDEnterprise applications that use SharePoint Online permissions
Shows Enterprise applications that use SharePoint Online permissions. Built-in Entra ID policy "Enterprise applications that use SharePoint Online permissions".
- Reference › Policies › Entra IDEnterprise applications using Exchange Web Services (EWS)
What the built-in Entra ID policy "Enterprise applications using Exchange Web Services (EWS)" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Entra IDEnterprise applications with full control or write permissions
What the built-in Entra ID policy "Enterprise applications with full control or write permissions" in Rencore Governance detects, and the rule behind it.
- Reference › ConnectorsEntra ID
What Rencore Governance covers for Entra ID: 22 object types and 14 policies, grouped by product area.
- Reference › ConnectorsExchange
What Rencore Governance covers for Exchange: 2 object types and 1 policy, grouped by product area.
- Reference › Policies › Power BIExternal sharing risk with external users
Identifies reports with external access permissions that may violate data protection policies. The "External sharing risk with external users" policy.
- Reference › Policies › Microsoft 365External users
Shows external users (users with user type 'Guest'). The built-in Microsoft 365 policy "External users": what it detects and the rule behind it.
- Reference › Policies › Claude EnterpriseExternal users in Claude organization
Detects users flagged as external in the corporate directory who have Claude access. Built-in Claude Enterprise policy "External users in Claude organization".
- Reference › Policies › Microsoft 365External users invited 3 month ago with pending acceptance
What the built-in Microsoft 365 policy "External users invited 3 month ago with pending acceptance" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Microsoft 365External users with pending acceptance
External users which have not accepted invitation to your tenant. Built-in Microsoft 365 policy "External users with pending acceptance".
- Reference › Policies › Copilot StudioExternal web content dependency risk
What the built-in Copilot Studio policy "External web content dependency risk" in Rencore Governance detects, and the rule behind it.
Show all 76 pages
- Reference › Policies › CopilotExternal website data source risk
What the built-in Copilot policy "External website data source risk" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Microsoft 365Global administrators without MFA
Shows global administrators that have not activated multi factor authentication. Built-in Microsoft 365 policy "Global administrators without MFA".
- Reference › Policies › Microsoft 365Groups with external owners
Shows groups that have external users as owners. The built-in Microsoft 365 policy "Groups with external owners": what it detects and the rule behind it.
- Reference › Policies › Microsoft 365Groups with external users
Shows groups that have external users. The built-in Microsoft 365 policy "Groups with external users": what it detects and the rule behind it.
- Reference › Policies › Microsoft 365Inactive external users
Shows external users that have not signed in for more than 6 month. Built-in Microsoft 365 policy "Inactive external users".
- Reference › Policies › Microsoft 365Inactive internal users
Shows internal users that have not signed in for more than 6 month. Built-in Microsoft 365 policy "Inactive internal users".
- Reference › Policies › ChatGPT EnterpriseInvitation sent to an external domain
Detects invitations to addresses that match no Entra ID user or match a guest. Built-in ChatGPT Enterprise policy "Invitation sent to an external domain".
- Reference › Policies › ExchangeMailboxes with external redirect rules
Shows mailboxes which have redirect rules that redirect to external domains. Built-in Exchange policy "Mailboxes with external redirect rules".
- Reference › ConnectorsMicrosoft 365
What Rencore Governance covers for Microsoft 365: 11 object types, 29 policies, 4 automations and 24 built-in actions, grouped by product area.
- Reference › ConnectorsOneDrive
What Rencore Governance covers for OneDrive: 4 object types, 7 policies, 3 automations and 3 built-in actions, grouped by product area.
- Reference › Policies › OneDriveOneDrive contains at least one externally shared file
What the built-in OneDrive policy "OneDrive contains at least one externally shared file" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › OneDriveOneDrive file is shared with external users
Identifies OneDrive files that have been shared externally, increasing the risk of data leakage. The "OneDrive file is shared with external users" policy.
- Reference › Policies › ChatGPT EnterpriseOver-shared project with external data sources
Detects ChatGPT projects that are broadly shared and also pull from an external system. The "Over-shared project with external data sources" policy.
- Reference › Policies › ChatGPT EnterprisePending invitation grants owner or admin rights
Detects pending invitations that would grant the owner or admin role on acceptance. The "Pending invitation grants owner or admin rights" policy.
- Reference › Policies › Claude EnterprisePlugin from outside the official directory
What the built-in Claude Enterprise policy "Plugin from outside the official directory" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › ChatGPT EnterprisePlugin listed to the whole workspace bundles an MCP server
Detects discoverable plugins that install an MCP server any member can reach. The "Plugin listed to the whole workspace bundles an MCP server" policy.
- Reference › ConnectorsPower Apps
What Rencore Governance covers for Power Apps: 4 object types, 3 policies, 4 automations and 4 built-in actions, grouped by product area.
- Reference › Policies › Power AppsPower Apps (canvas apps) shared with everyone
Shows Power Apps that all users of current tenant can viewed and used. Built-in Power Apps policy "Power Apps (canvas apps) shared with everyone".
- Reference › ConnectorsPower BI
What Rencore Governance covers for Power BI: 12 object types and 10 policies, grouped by product area.
- Reference › Policies › Power BIPower BI dashboards with external access
Identifies dashboards specifically shared externally which may contain aggregated sensitive information. The "Power BI dashboards with external access" policy.
- Reference › Policies › Power BIPower BI reports without classification
Identifies reports lacking required sensitivity classification to ensure data governance compliance. The "Power BI reports without classification" policy.
- Reference › Policies › Power BIPower BI Workspaces with external access
Identifies workspaces where external users have been granted access rights. Built-in Power BI policy "Power BI Workspaces with external access".
- Reference › Policies › Power BIPower BI Workspaces without administrators
Identifies workspaces lacking designated administrative ownership, creating accountability risks. The "Power BI Workspaces without administrators" policy.
- Reference › Policies › Claude EnterpriseProject visible to the whole organization
Detects Claude projects that are not private and therefore visible to every organization member. The "Project visible to the whole organization" policy.
- Reference › Policies › TeamsPublic Teams
Shows public teams. The built-in Teams policy "Public Teams": what it detects and the rule behind it.
- Reference › Policies › Entra IDRisky sign-ins
Shows Sign-Ins with risk state "At Risk". The built-in Entra ID policy "Risky sign-ins": what it detects and the rule behind it.
- Reference › Policies › TeamsShared channels with external access
All Shared Channels that have external user access. The built-in Teams policy "Shared channels with external access": what it detects and the rule behind it.
- Reference › Policies › ChatGPT EnterpriseShared Codex environment with repository access
Detects Codex sandboxes that are shared and can reach source repositories. Built-in ChatGPT Enterprise policy "Shared Codex environment with repository access".
- Reference › ConnectorsSharePoint
What Rencore Governance covers for SharePoint: 14 object types, 32 policies, 9 automations and 19 built-in actions, grouped by product area.
- Reference › Policies › SharePointSharePoint agent is not approved
Identifies SharePoint agents that have not been reviewed or approved before use, posing security risks. The "SharePoint agent is not approved" policy.
- Reference › Policies › SharePointSharePoint agent references confidential site without approval
What the built-in SharePoint policy "SharePoint agent references confidential site without approval" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › SharePointSharePoint extranet sites
Sites without MS Teams where External Sharing is active. The built-in SharePoint policy "SharePoint extranet sites": what it detects and the rule behind it.
- Reference › Policies › SharePointSharePoint file is shared with external users
Detects SharePoint files that have been shared externally, potentially exposing sensitive data. The "SharePoint file is shared with external users" policy.
- Reference › Policies › SharePointSharePoint file is shared with inactive external user
What the built-in SharePoint policy "SharePoint file is shared with inactive external user" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › SharePointSharePoint site collection is owned by external users
What the built-in SharePoint policy "SharePoint site collection is owned by external users" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › SharePointSharePoint site collection lacks sensitivity label
Detects SharePoint site collections missing sensitivity labels, increasing data security risks. The "SharePoint site collection lacks sensitivity label" policy.
- Reference › Policies › SharePointSharePoint site has broken permission inheritance
Detects SharePoint sites where permission inheritance is broken, increasing security risks. The "SharePoint site has broken permission inheritance" policy.
- Reference › Policies › SharePointSharePoint subsite has unique permissions
Detects SharePoint subsites that have unique permissions, making security management complex. The "SharePoint subsite has unique permissions" policy.
- Reference › Policies › Claude EnterpriseSingle sign-on not enforced
Detects organizations where the sso_enforced setting is present but disabled. Built-in Claude Enterprise policy "Single sign-on not enforced".
- Reference › Policies › TeamsTeam contains Copilot agent and external members
What the built-in Teams policy "Team contains Copilot agent and external members" in Rencore Governance detects, and the rule behind it.
- Reference › ConnectorsTeams
What Rencore Governance covers for Teams: 10 object types, 22 policies, 9 automations and 11 built-in actions, grouped by product area.
- Reference › Policies › TeamsTeams with external users
Shows all Teams that have external users/guests. The built-in Teams policy "Teams with external users": what it detects and the rule behind it.
- Reference › Policies › TeamsTeams with inactive external users
Shows teams with external members that have not logged in for more than 6 month. Built-in Teams policy "Teams with inactive external users".
- Reference › Policies › Copilot StudioUnauthenticated public agent security risk
What the built-in Copilot Studio policy "Unauthenticated public agent security risk" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Claude EnterpriseUnidentified plugin activity
What the built-in Claude Enterprise policy "Unidentified plugin activity" in Rencore Governance detects, and the rule behind it.
- Reference › Policies › Microsoft 365Users with passwords not changed in last 6 months
Shows users that have not changed their password for more than 6 months. Built-in Microsoft 365 policy "Users with passwords not changed in last 6 months".
FAQ 2
- FAQWhat are the different types of users?
Microsoft has four types of users: internal members, external members, internal guests and external guests. Rencore Governance tells them apart by whether the…
- FAQWhat does the external access information in workspace details show me?
The Site Access and File Access sections show you exactly who has access to your workspace content and how. This includes external users (people outside your…
Glossary 7
- GlossaryExternal user
An external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.
- GlossaryPermission inheritance
SharePoint sites, lists, folders and files inherit their permissions from their parent by default. When inheritance is broken, the item gets unique permissions…
- GlossaryPermission level
A permission level is a named set of SharePoint permissions, such as Full Control, Edit or Read, that you grant to a user or a SharePoint group.
- GlossaryPrivate channel
A private channel is a Microsoft Teams channel that only some members of the team can see. It has its own SharePoint site for its files.
- GlossaryShared channel
A shared channel is a Microsoft Teams channel that people from outside the team, and from other organizations, can join without joining the team.
- GlossarySharePoint group
A SharePoint group is a set of users defined in a SharePoint site and given a permission level, such as the Owners, Members or Visitors group of the site.
- GlossarySharing link
A sharing link is a link in SharePoint or OneDrive that grants access to a file or folder, sometimes to people outside your organization.