How it works

Add it, check, fix what matters, track the score.

ExposurePoint is a web part. It runs on a SharePoint page, in the browser of the person looking at it, with their own permissions. There is nothing else to install and no server of ours in the way.

Add

Uploaded once, added to any page.

A SharePoint administrator uploads ExposurePoint to your organisation's app catalog once and makes it available to all sites. From then on, any site owner can edit a page, choose Add a web part and pick ExposurePoint.

No Microsoft Graph permissions and no admin consent to approve
Works on any modern SharePoint Online page
The free score appears straight away, with or without a licence

Check

It reads who can open what, then scores it.

ExposurePoint reads the site's permissions, its groups, every sharing link, the libraries and files with their own permissions, its guests, owners, last activity and sensitivity label. It reads names and permissions only, never what is inside your files.

Compares every file with its own permissions against the site, so only real exposure counts
Ranks the risks highest first, with the points each one is worth
If something could not be read, it says so and never shows an all-clear

ExposurePointFinance team site Settings

How exposed is this site to Microsoft 365 Copilot?

Some exposure - review recommended

Score 53 of 100 - a higher score means lower exposure.

Fix the 3 items ExposurePoint can fix here and the score rises to 95.

What to fix Highest risk first.

Links for anyone in your organisation (2)Files and folders shared with organisation links+27 points if fixedFix here
External guestsExternal guests known to this site collection+25 points if fixedFix here
Content here has no sensitivity label appliedNo sensitivity label applied to this siteReview to fix

Fix

Choose what to fix, read what will change, confirm.

Open a finding to see its files, links or people. Tick the ones to fix and ExposurePoint shows exactly what will change and who will lose access before it does anything. After the fix it checks the site again to prove it worked.

Anyone and organisation linksRemoved. People given access directly keep it.

Whole-organisation accessRemoved from the site, group, library or file. Owners, members and visitors keep theirs.

External guestsRemoved from the site collection. They can be invited again.

Files open wider than the siteGiven the site's permissions again. The extra people lose access; nobody gains it.

ExposurePointFinance team site Settings

Remove 2 links?

What changes: People who reached the file through these links lose access. People given access directly keep it. You can share again at any time.

Budget 2027.xlsx - Documents > Planning
Supplier contracts - Documents

CancelRemove links

Track

The score keeps its own history.

Once a day, or whenever the score changes, ExposurePoint saves it to a hidden list on your site, so the trend builds without anyone remembering. Download a report with every finding to keep, or to send to IT for the things only an administrator can change.

History stays in your SharePoint site
Several sites can share one history list if you prefer
The report needs nothing but a browser to open

Who can do what

Everyone sees what they can read. Only people who can manage the site can fix.

Anyone who can open the page sees the score for what they can read. Visitors with less access may see a partial result, and ExposurePoint says so.
People who can manage permissions on the site are offered the fixes. Everyone else is told who to ask, and can download the report for them.
Your Microsoft 365 administrator handles what a site owner cannot: owners for ownerless sites, sensitivity labels and tenant-wide sharing settings.