Lakewood Legal Group has deployed Microsoft 365 Copilot for its attorneys. Within two weeks, attorneys report that Copilot is surfacing confidential settlement documents from other case teams in its responses. The Microsoft 365 admin suspects widespread data oversharing in SharePoint. Which tool should the admin use first to identify and report on sites and files that are accessible to more users than intended?

SharePoint Advanced Management (SAM) includes data access governance reports specifically designed to surface oversharing issues before or after Copilot deployment. These reports identify sites shared with 'Everyone except external users', sites with numerous sharing links, and sites lacking sensitivity labels — all of which represent data that Copilot can legitimately access and include in its responses. SAM is the correct first step for scoping the problem and generating a remediation list.

Option A is incorrect because Purview Content Explorer helps you find WHERE sensitive data types exist (files containing credit card numbers, SSNs, etc.), but it does not surface access control issues or tell you which sites are overshared. It's a data classification tool, not a permissions auditing tool.

Option C is incorrect because Defender for Cloud Apps anomaly detection is useful for detecting suspicious access behavior, not for systematically identifying permissions that are broader than intended by design. It's reactive, not proactive.

Option D is incorrect because Microsoft 365 usage analytics reports focus on productivity metrics (who uses which apps and how often), not on who has access to what. They don't surface permission scope problems.

Exam tip: The AB-650 exam frequently pairs data oversharing scenarios with SharePoint Advanced Management. Know that SAM produces three key report types: sites shared with everyone, sites with many external sharing links, and sites without sensitivity labels.