Risk 1 of 8
Anyone links
Links that open a file or folder without signing in. They are easy to forward and you cannot see who has them.
Remove the links you do not need, here, after you confirm.
Points-30 for the first, -3 for each after, up to -45
What it checks
Eight risks, one score, and the rules behind it.
ExposurePoint follows Microsoft's own guidance on getting SharePoint ready for Copilot: the same risks, ranked the same way, including Microsoft's rule that risks which overlap are worse than either alone.
How the score works
Start at 100. Each risk takes points off.
The first occurrence of a risk costs the most; each one after costs a little, up to a cap. So removing most of a problem shows progress straight away, and a site never drops below 0.
71 to 100Lower exposure
41 to 70Some exposure - review recommended
0 to 40High exposure - act before relying on Copilot here
Risk 2 of 8
Open to everyone in your organisation
"Everyone except external users" or "Everyone" on the site, inside its groups, on a library or on a file. Common on public teams.
Remove whole-organisation access; owners, members and visitors keep theirs.
Points-30 for the first place, -5 for each after, up to -40
Risk 3 of 8
Links for anyone in your organisation
Links any colleague can use. Everyone who opens one keeps access, so Copilot can bring the file into their answers.
Remove the links, then share with the people who need the file.
Points-15 for the first, -2 for each after, up to -30
Risk 4 of 8
External guests
People outside your organisation with accounts in the site collection, who may still reach content they no longer need.
Remove guests who no longer need access.
Points-15 for the first, -3 for each after, up to -30
Risk 5 of 8
Files and folders open wider than the site
Items with their own permissions that let in people who cannot see the rest of the site. Items locked down tighter are left alone.
Give them the site's permissions again: the extra people lose access, nobody gains it.
Points-10 for the first, -2 for each after, up to -25
Risk 6 of 8
No owner
Nobody is responsible for who can see the site, so access grows and is rarely reviewed.
Explains who can add an owner (your Microsoft 365 administrator).
Points-15
Risk 7 of 8
Site looks inactive
Nothing has changed for a long time (90 days by default). Old content can still turn up in Copilot answers.
Explains how to archive what nobody needs.
Points-8
Risk 8 of 8
No sensitivity label applied
The site has no sensitivity label. ExposurePoint can see that a label is missing; it cannot tell whether the content itself is sensitive.
Explains how a site owner or administrator applies one.
Points-5, for information
When risks overlap
Two or more risks on the same site take another 10 points off. The combinations Microsoft names as high risk take 20 instead: Anyone links, organisation links or whole-organisation access together with no owner, or together with files open wider than the site.
Example: one Anyone link, no owner and one file open wider than the site score 25, high exposure.
Good to know, never scored
- Files locked down tighter than the site lower exposure and are left alone.
- Files whose own permissions now match the site get a no-change tidy-up.
- Links to specific people are counted but not scored.
- Whether members can share is shown as a setting to consider.
When it cannot see everything
The score reflects what the person using it can read. If part of the site could not be read, or a very large site has more files than one check covers, the result says that real exposure may be higher and never shows an all-clear.
A fixed, published model
The weights are the same for every customer, so scores compare across sites. Each saved score records the model version, so a future change to the weights is never mistaken for a change to your site.