TrueNorth Data Shield · Microsoft 365 Exposure & Copilot Readiness
Tamberlin Supply Co. (sample)
Sample report · fictional company and data · 24 users · Reviewed 2026-10-10T18:00:00+00:00 · 14 sites
F
Score 14/100
3Items with "Anyone" links
2Shared org-wide
2/3Stale guests
6Global admins
Copilot readiness
Not ready. Copilot can surface anything a user already has access to. Resolve the critical and high items below before enabling or expanding Copilot.
(5 Copilot licenses currently assigned.)
Findings and recommendations
critical · 2
Sensitive-looking files open to anyone with the link
"Anyone" links need no sign-in. If forwarded or posted, the file is public. These names suggest HR, finance or legal content.
Recommendation: Remove the Anyone link or replace it with a 'Specific people' link as a first priority.
Office
/HR/Payroll 2026.xlsx
anonymous
Office
/HR/Onboarding/Staff SSN list.docx
anonymous
critical · 1
Guest accounts hold admin roles
An outside identity can administer the tenant.
Recommendation: Remove admin roles from guest accounts as a first priority.
Anyone links work without sign-in, so access isn't tied to a named person.
Recommendation: Review each link; set the tenant default link type to 'Specific people' and require expiry (SharePoint admin center > Policies > Sharing).
Office
/HR/Payroll 2026.xlsx
anonymous
Office
/HR/Onboarding/Staff SSN list.docx
anonymous
Marketing
/Spring flyer.pdf
anonymous
high · 1
Tenant allows "Anyone" sharing
The organization-level setting permits unauthenticated links everywhere.
Recommendation: Lower SharePoint external sharing to 'New and existing guests' unless there is a business need.
high · 6
6 Global Administrators
Microsoft recommends fewer than five; each one is a full-tenant compromise path.
Recommendation: Reduce to 2-4 break-glass or named admins; move others to least-privilege roles.
Office Manager
office@tamberlinsupply.example
Owner
owner@tamberlinsupply.example
Sales Desk
sales@tamberlinsupply.example
IT Admin
it@tamberlinsupply.example
Old Admin
old@tamberlinsupply.example
Backup Admin
backup@tamberlinsupply.example
medium · 2
Anyone links that never expire
Links without expiry stay live indefinitely after the project ends.
Recommendation: Set 'These links must expire within N days' (30 recommended).
Office
/HR/Payroll 2026.xlsx
anonymous
Office
/HR/Onboarding/Staff SSN list.docx
anonymous
medium · 2
Content shared with everyone in the organization
Copilot answers from anything a user can reach. Organization-wide links make these files discoverable to every employee through Copilot and search.
Recommendation: Narrow to the team or people who need it; prioritize anything sensitive.
Leadership
/Acquisition notes
organization
Leadership
/Finance/Budget FY27.xlsx
organization
medium · 1
Files shared directly with outside email addresses
External people retain access until it is removed.
Recommendation: Confirm each outside party still needs access; remove the rest.
Office
/Insurance contracts
medium · 2
Guest accounts inactive for 90+ days
Old guest accounts keep whatever access they were given.
Recommendation: Remove these guests or run an Entra access review for them.
Old Contractor
j@oldvendor.example
645
last sign-in
Former IT MSP
tech@priormsp.example
1258
created (no sign-in data)
Review notes
Sample report. Tamberlin Supply Co. is a fictional company. Every name, email address, file and figure is invented for illustration. It is not a TrueNorth customer and does not show a real result.