Microsoft SharePoint Data Access Governance Report: New Group Permissions Feature Coming in 2026

Microsoft is preparing to introduce a new Data access governance report in the SharePoint admin center, giving administrators greater visibility into which SharePoint sites are accessible to specific groups and the level of access those groups hold.

Announced in Microsoft 365 Message Center notification MC1540348 on November 5, 2026, the feature is scheduled to begin rolling out worldwide in late November, with general availability expected by early December 2026. The rollout will also cover Government Community Cloud (GCC), GCC High, and Department of Defense (DoD) environments.

The update addresses a persistent challenge for organizations using SharePoint: understanding how broadly internal and external groups can access company information. With large permission groups, vendor accounts, and growing Microsoft 365 environments, administrators can struggle to identify where sensitive information might be exposed.

The new reporting capability is designed to make those relationships easier to investigate, helping IT teams review permissions and identify potential access risks before they become security incidents.

What Is the New Microsoft SharePoint Data Access Governance Report?

The new report is an addition to Microsoft’s Data access governance capabilities within the SharePoint admin center.

Its primary purpose is to allow SharePoint administrators to identify all sites accessible to a particular group and understand the extent of that group’s permissions across those sites.

Rather than relying on fragmented permission reviews or manually checking individual SharePoint sites, administrators will have a dedicated reporting capability for investigating group-based access.

This is particularly relevant for organizations that manage hundreds or thousands of SharePoint sites, where permissions can become difficult to track as teams grow, employees change roles, and external collaborators are added.

Microsoft specifically highlights groups with broad membership, including groups created for vendors, as a potential source of unintended data exposure.

For example, a vendor collaboration group might initially be created to provide access to a specific project site. Over time, additional permissions or changes to group membership could result in that group having access to other sites containing information that its members do not need.

The new report should help administrators identify these relationships and investigate whether the assigned access remains appropriate.

Why SharePoint Group Permissions Have Become a Security Concern

SharePoint permissions are central to how organizations control access to documents, collaboration spaces, and business information.

However, managing access becomes increasingly complicated as organizations expand their Microsoft 365 environments.

Employees belong to multiple teams, departments use shared resources, and external partners frequently require temporary or ongoing access to project information. These relationships can create overlapping permission structures that are difficult to audit manually.

Some common sources of unnecessary access include:

Broad membership groups: Large groups can include employees or external collaborators who do not need access to every resource assigned to the group.
Vendor and contractor accounts: External groups may retain access to SharePoint sites after a project or business relationship changes.
Inherited permissions: Access granted through parent sites or connected groups can extend further than administrators initially intended.
Organizational changes: Employee transfers, departures, and departmental restructuring can leave outdated permissions in place.
Permission sprawl: As new sites and collaboration spaces are created, access assignments can accumulate without consistent review.

The challenge is not necessarily that every broad permission represents a security vulnerability. Many organizations intentionally use shared groups to simplify collaboration.

The problem arises when administrators cannot easily establish whether the people behind those groups still have a legitimate business reason to access the resources.

Microsoft’s new reporting capability aims to make that investigation more manageable.

How the New Group Permissions Report Will Help Administrators

The most important aspect of the announcement is the ability to investigate SharePoint access from the perspective of a specific group.

Administrators will be able to identify:

Which SharePoint sites a selected group can access.
The extent of that group’s access across those sites.
Potential exposure involving groups with broad membership.
Permission assignments that may require further investigation or review.

This visibility can help IT teams prioritize their security reviews instead of treating every SharePoint site as an isolated permission-management task.

Consider an organization with separate SharePoint environments for finance, human resources, operations, and external vendor collaboration.

A vendor group might have been granted access to a project workspace several months earlier. If that group subsequently receives access to additional sites, administrators need a practical way to determine whether those permissions are justified.

With the new report, they can investigate the group’s access across SharePoint sites and identify areas that deserve closer examination.

Importantly, the report is intended to support investigation and verification. It should not be interpreted as an automatic permission-removal or remediation feature.

Administrators will still need to evaluate business requirements and make appropriate access changes.

Why the Update Matters for Microsoft 365 Copilot

One of the most significant aspects of Microsoft’s announcement is its connection to Copilot readiness.

Microsoft explicitly identifies reviewing group permissions before assigning Copilot licenses as one of the potential uses for the new report.

This reflects an important consideration in Microsoft 365 security: AI assistants can make existing organizational information easier to discover, but they do not automatically correct inappropriate permissions.

Microsoft 365 Copilot respects existing user permissions. This means that information a user is already authorized to access may become easier to find and work with through Copilot experiences.

If an employee has unnecessarily broad access to sensitive SharePoint content, that underlying permission issue deserves attention before broader AI adoption.

For example, an employee working in a vendor-facing project team might have access to internal documents belonging to other departments because of an outdated group assignment.

Even if the employee rarely visits those sites, the permissions may still allow access to their content.

As organizations introduce Copilot across departments, reviewing these access relationships becomes increasingly important.

The new group permissions report can contribute to that preparation by helping administrators identify which sites are accessible through specific groups.

It is not a complete Copilot security assessment, but it provides another useful layer of visibility into the permission structure that governs organizational data.

How the New Report Fits Into Microsoft’s Existing Data Governance Tools

The upcoming group permissions report builds on Microsoft’s broader Data access governance capabilities.

Microsoft already provides reporting options designed to help organizations understand SharePoint and OneDrive access patterns, including reports covering site permissions, user permissions, sensitivity labels, and sharing activity.

These capabilities serve different purposes.

For example, existing site permissions reporting provides an organization-wide view of permission structures, helping administrators identify sites with broad access.

The site permissions for users report takes a different approach by showing which sites a particular user can access, including whether access is granted directly or indirectly through groups.

The newly announced group permissions report addresses another important perspective: identifying the sites accessible to a particular group.

Together, these reporting approaches can help organizations build a more complete picture of how access is distributed across their Microsoft 365 environment.

Microsoft also recommends combining snapshot reports with activity reports as part of an ongoing data governance strategy.

Snapshot reports help administrators understand the current permission landscape, while activity reports provide insight into sharing-related activity over time.

Organizations can use these different views to identify potential oversharing, investigate unusual access patterns, and establish more consistent permission-review processes.

Rollout Schedule: When Will the SharePoint Feature Be Available?

According to Microsoft 365 Message Center notification MC1540348, the new group permissions reporting capability is scheduled for general availability across several Microsoft cloud environments.

The announced rollout schedule is:

Worldwide: Rollout begins in late November 2026.
GCC: Included in the general availability rollout.
GCC High: Included in the general availability rollout.
DoD: Included in the general availability rollout.
Expected completion: Early December 2026.

The feature will be available through the Microsoft SharePoint admin center, specifically within the Data access governance experience.

SharePoint administrators responsible for managing site permissions and reviewing organizational access should monitor the rollout and check their admin center once the feature becomes available.

Microsoft has not identified any additional compliance considerations for this particular update in its announcement.

However, organizations should continue reviewing the change against their internal security, privacy, and governance requirements.

What Organizations Should Do Before the Rollout

Although the new report does not require organizations to completely redesign their SharePoint permission structures, administrators can take several practical steps to prepare.

1. Review existing SharePoint permissions

Start by identifying groups with broad membership and reviewing which SharePoint sites they currently access.

Pay particular attention to groups containing external users, vendors, and contractors.

2. Identify outdated access assignments

Review whether former employees, contractors, and external partners still belong to groups that provide access to internal SharePoint resources.

Remove unnecessary memberships through the organization’s established identity and access management processes.

3. Establish a regular permission-review process

Avoid treating access reviews as a one-time activity.

Organizations should establish recurring reviews to ensure that group membership and site permissions continue to reflect actual business requirements.

4. Prepare for Copilot deployment

Before assigning Microsoft 365 Copilot licenses, review whether users have access to information beyond what they need for their roles.

The new group permissions report can support this process by making group-based access easier to investigate.

5. Update internal IT documentation

Notify SharePoint administrators about the upcoming feature and update internal procedures to include the new reporting capability.

This will help ensure that teams understand how to incorporate the report into existing governance and security workflows.

What This Means for the Future of SharePoint Security

Microsoft’s upcoming group permissions report highlights an important direction for SharePoint administration: better visibility into how organizational information is shared through groups, not just individual user accounts.

As Microsoft 365 environments become more interconnected, understanding who can access information requires more than checking individual site settings.

Group membership, inherited permissions, external collaboration, and AI-powered information discovery all contribute to the broader access landscape.

The new report should make it easier for administrators to investigate these relationships and identify permissions that may no longer match business requirements.

Its value will ultimately depend on how organizations incorporate the reporting capability into their regular governance practices.

For businesses preparing to expand Microsoft 365 Copilot usage, the timing is particularly relevant. Reviewing access before introducing AI-powered productivity tools can help reduce the risk of making unnecessarily accessible information easier to discover.

With rollout expected between late November and early December 2026, SharePoint administrators should begin reviewing their existing permission-management processes now.

The next step for organizations will be to turn the additional visibility into consistent access reviews, stronger collaboration controls, and better protection of sensitive business information.