An emergency-management office finds that everyone in the tenant can open a confidential folder and must troubleshoot the cause. Which approach aligns with AB-900 oversharing guidance?

When an emergency-management office finds that everyone in the tenant can open a confidential folder, AB-900-aligned guidance is to use oversharing troubleshooting tools to identify excessive Everyone or broad-link sharing on the folder or site. The tools show how permissions or links became too wide so staff can remediate the actual ACL or sharing configuration causing the exposure.

Use Conditional Access sign-in insights to review oversharing via Everyone or broad-link sharing on the site misdirects the investigation: Conditional Access insights show sign-in conditions, not who the folder or its links are already shared with. Use sensitivity label encryption analytics to review oversharing via Everyone or broad-link sharing on the site misdirects the investigation: sensitivity label analytics reflect encryption status but do not reveal or fix broad sharing links or ACLs that grant Everyone access. Use SharePoint site storage metrics to review oversharing via Everyone or broad-link sharing on the site misdirects the investigation: storage metrics show capacity usage but do not identify or fix excessive Everyone or broad-link sharing that causes the exposure.

Exam caveat: Permission problems are often the root cause of access issues. Troubleshoot oversharing before relying on Conditional Access sign-in insights, sensitivity label encryption analytics, or SharePoint site storage metrics. Oversharing tools identify excessive Everyone/broad sharing; they are not a reason to lean on those unrelated checks.

Operational check: Open oversharing troubleshooting for the confidential folder’s site, confirm Everyone or organization-wide links/groups on the folder, remove broad grants, replace with need-to-know security groups, verify emergency staff who still require access remain in the correct groups, and retest that unauthorized staff can no longer open the folder. Document findings for the housing authority’s privacy officer.