What replaces the Copilot in SharePoint site exclusion list after 1 November 2026

Good writeup. For anyone now trying to work out which sites are actually overshared, the data access governance reports in the SharePoint admin center are the quickest start. The site permissions report gives you the baseline (huge user counts, guests, Everyone except external users) and the EEEU and sharing links reports show what happened in the last 28 days.

From there I'd hand it to site owners with site access reviews instead of fixing everything from IT. Owners get an email about that specific issue. They know whether the finance planning site should really be open to the whole company, we usually don't.

Ownerless sites won't get reviewed by anybody, so they need their own pass. And agree on RCD being a stopgap. It hides the site from Copilot and org wide search but anyone who already has access can still open the files.