What SharePoint Advanced Management is
Microsoft Learn describes SAM as administrative governance controls for SharePoint and OneDrive that do three jobs: manage content sprawl, manage the content lifecycle and prevent oversharing. It lives in the SharePoint admin centre rather than in Purview, and it is aimed at the SharePoint and Microsoft 365 administrators responsible for governance, risk reduction and audit readiness. Microsoft's own framing since 2025 has been that these capabilities exist to get a tenant ready for Copilot and agents, because Copilot answers with whatever the asking user can already reach — so anything overshared in SharePoint becomes reachable in a prompt. SAM is the tooling to find and fix that before the licences land.
What's inside
Sprawl: site ownership policies, inactive-site policies and site attestation requests. Lifecycle: catalogue management to group sites, change-history reports covering 180 days, a recent-actions panel and restricted site creation by apps. Oversharing: restricted access control to lock a site to a group, restricted content discovery to keep high-risk sites out of Copilot and organisation-wide search, block-download policies, and the data access governance reports — permission-state snapshots for sites and files, sites a given user can reach, sensitivity-label distribution, sharing-link activity and 'Everyone except external users' exposure over the last 28 days. On top sit site access reviews delegated to site owners, AI insights on the reports, agent-access insights, a content management assessment hub and the SharePoint Admin Agent.
Who gets it and what it costs
Microsoft Learn's prerequisites page gives three ways in. If at least one user in the organisation is assigned a Microsoft 365 Copilot licence — that user need not be an administrator — SharePoint admins automatically receive the SAM capabilities that support the Copilot deployment. Otherwise, a tenant with SharePoint Kiosk, Plan 1 or Plan 2 can buy the SharePoint Advanced Management Plan 1 add-on through the Microsoft 365 admin centre, a CSP or volume licensing. Microsoft 365 E7 includes it too. A handful of features, notably restricted site creation by apps, stay add-on-only even for Copilot tenants. Microsoft's public product pages for the add-on returned no price when Frontrow checked in September 2026, so confirm the current per-user rate with your CSP.
Why it is the Copilot oversharing shield
Copilot retrieves from Microsoft Graph and respects existing permissions, which sounds reassuring until you remember how permissive most tenants are: 'Anyone' links, sites shared with everyone except external users, ownerless sites and broken inheritance nobody has looked at in years. SAM is the only Microsoft toolset that reports that exposure at tenant scale and then gives admins the levers — restricted access control to cut a site back to a group, restricted content discovery to hide it from Copilot without changing permissions, and site access reviews to push the clean-up to the people who actually know what the content is. Microsoft's own Copilot-readiness guide is built around exactly these steps.
Frontrow's sequence
Run the content management assessment first — it takes minutes, surfaces overshared and ownerless sites, and Microsoft recommends rerunning it every 30 days. Then work the data access governance reports in order: the site-permissions baseline to see how bad it is, the sharing-links and 'Everyone except external users' reports to find the active leaks, and site access reviews to delegate remediation. Apply restricted content discovery to anything sensitive you cannot fix before Copilot goes live, and restricted access control to the handful of sites that should never be broad. Only then set lifecycle policies so the sprawl does not return. Doing this in the first fortnight of a Copilot project is cheaper than any incident response.