How can we find where sensitive data is stored across SharePoint, OneDrive, Teams, and on-prem file shares?

AI work has turned SharePoint, OneDrive, Teams, and on‑prem file shares into one continuous data surface. Your sensitive data is everywhere. Your controls often are not. The core challenge isn’t just “where is my data?”—it’s “where is my sensitive data exposed, and what can I do about it right now?”

Below is a practical, board-ready way to answer that, with a focus on Microsoft 365 and file servers, and how we’ve approached it with Forcepoint’s Self-Aware Data Security platform.

---

What “finding” sensitive data really means

To move from guesswork to control, you need more than a one-time scan or a static inventory. A workable approach must:

• Discover sensitive data continuously across SharePoint, OneDrive, Teams, and on‑prem file shares
• Classify it with enough context to distinguish truly sensitive content from noise
• Map exposure—who can access it, how it’s shared, where it’s overshared
• Prioritize and remediate risks, not just report on them
• Enforce protections using the same policies everywhere data moves

Think of this as a loop, not a project: visibility → classification → risk → remediation → ongoing enforcement.

---

Step 1: Build a unified inventory across SharePoint, OneDrive, Teams, and file shares

Most organizations start with fragmented tools—one for SharePoint, another for endpoints, a third for DSPM. That’s how blind spots happen.

Instead, you want a single engine that can:

• Connect to Microsoft 365: SharePoint Online, OneDrive for Business, Teams sites and chat files
• Connect to on‑premises file servers: SMB/CIFS shares, NAS appliances, home directories
• Scan both structured and unstructured data: documents, spreadsheets, PDFs, logs, exports, and database dumps left in file shares

In Forcepoint, this is handled through the Data Security Cloud connectors and discovery engines, giving you one console to see:

• Which repositories you’ve onboarded
• How many files and folders are in scope
• Data growth and churn over time

Operationally, you’re setting up continuous discovery jobs, not "one and done" scans.

What you’ll see:

• A global inventory of data locations across SharePoint sites, OneDrive accounts, Teams, and file shares
• Volume metrics: file counts, data size, last modified timestamps
• Initial heatmaps showing which locations are most active or most exposed

---

Step 2: Classify sensitive data with explainable AI, not just regex

Finding “where” sensitive data is stored starts with knowing “what” is sensitive—far beyond simple keywords and pattern matching.

You need an engine that can:

• Understand context (is that 9-digit number truly an SSN or a random ID?)
• Classify unstructured content (contracts, design docs, source code, HR files) at scale
• Use prebuilt policy templates for regulated data (PCI, HIPAA, GDPR, etc.)
• Allow custom categories (e.g., “M&A,” “trade secrets,” “board materials”)

Forcepoint does this with AI Mesh Data Classification, built on a Small Language Model (SLM) and other classifiers. The SLM focus matters: it’s efficient (no GPU farm required), runs close to your data, and—critically—produces explainable results you can audit.

Alongside AI Mesh, you can leverage 1,800+ templates and classifiers (nearly 2,000 with the latest expansion) to accelerate:

• PII/PHI detection
• Financial and payment data
• Source code and IP
• HR, legal, and confidential business documents

What you’ll see:

• Files in SharePoint, OneDrive, Teams, and file shares automatically tagged with persistent labels
• Category breakdowns (e.g., PII vs. IP vs. financial data) per repository
• Confidence scores and “why this was classified” explanations for audits and tuning

---

Step 3: Map where sensitive data is exposed and overshared

Classification alone doesn’t tell you where you’re at risk. You also need to understand who can access what, and how far that access really extends.

The critical questions:

• Which sensitive files are publicly shared?
• Which are shared externally with third parties?
• Which are overshared internally, far beyond least privilege?
• Who are the users with access to the most sensitive files?

With Forcepoint’s Self-Aware Data Security, you can:

• Identify overexposed data that is:
  • Publicly accessible
  • Shared with external domains or guest accounts
  • Shared to “Everyone,” “Everyone except external,” or large distribution groups
• View permissions for every unstructured data file:
  • See individual user access per file
  • Quickly pinpoint users and groups with access to the largest volumes of sensitive data
• Spot over‑permissioned files and folders that violate least privilege

What you’ll see:

• Dashboards highlighting:
  • Sensitive files with public or external links
  • Sensitive data in “open” SharePoint sites or Teams channels
  • Files with “ownerless” or stale access
• Exposure summaries by:
  • Repository (e.g., specific SharePoint site collections, file servers)
  • Sensitivity level (e.g., Highly Confidential vs. Internal)
  • Department or business unit

This is where you start turning a vague concern—“we’re probably exposed”—into a quantifiable exposure footprint.

---

Step 4: Prioritize by risk, not just file count

If you treat every sensitive file as equal, you’ll drown your team. You need to focus on the intersection of sensitivity, exposure, and activity.

Key prioritization signals:

• Sensitivity level: Highly regulated (PCI, HIPAA, national ID), IP, executive communications
• Exposure type:
  • Public internet
  • External sharing with third parties
  • Excessive internal groups or “Everyone”
• Business context: Who owns the data? Which department? Which project or Teams channel?
• User behavior: High-risk users, unusual access patterns, data exfiltration signals

Forcepoint’s Risk-Adaptive Protection (RAP) layers behavior and context onto classification so you can:

• Elevate risk scores for files with both high sensitivity and high exposure
• Flag users who are touching or sharing large volumes of sensitive data
• Feed those risk scores into automated policies and workflows

What you’ll see:

• Ranked lists of:
  • Top risky repositories (e.g., an HR file share exposed to all employees)
  • Top risky users (e.g., a contractor with wide access to R&D files)
  • Top exposure patterns (e.g., sensitive data in public Teams channels)
• Clear “fix first” guidance that security and data owners can align on

---

Step 5: Remediate exposure—automatically, where it’s safe

Too many DSPM tools stop at reports. Finding where sensitive data is stored is only valuable if you can reduce the risk without crippling the business.

You should be able to:

• Adjust file permissions directly:
  • Remove public links
  • Restrict external access
  • Reduce group-level access down to least privilege
• Prevent oversharing in near real time:
  • Block new external sharing of highly sensitive data
  • Stop users from sending sensitive files to personal accounts
• Move or quarantine data:
  • Relocate sensitive files to secure repositories
  • Quarantine mislocated data (e.g., PHI in a broad marketing share)
  • Delete or archive redundant, outdated, or trivial (ROT) data
• Deduplicate sensitive data:
  • Reduce copies of the same high-value file sprawled across Teams, OneDrive, and file shares

Forcepoint’s platform supports precise enforcement and remediation at scale, integrated with a single-policy framework so the same logic applies across:

• SharePoint, OneDrive, Teams
• On‑prem file shares
• SaaS apps, web, email, endpoints, networks, and AI workflows

What you’ll see:

• One-click or automated remediation actions:
  • “Remove external access”
  • “Remove public sharing link”
  • “Restrict to group X”
  • “Move to secure location”
• Audit logs showing:
  • Who changed what access, when, and why
  • Before/after permission snapshots for compliance evidence

---

Step 6: Enforce single policies everywhere data moves

Knowing where sensitive data lives in SharePoint, OneDrive, Teams, and file shares is only half the puzzle. You also need to stop that data from leaking when people use:

• Email (Exchange, other mail systems)
• Web and personal cloud storage
• AI tools and copilots
• Endpoints (USB, printing, local sync)
• Other SaaS apps (Salesforce, Box, Dropbox, Slack, Zoom, Google Workspace, and more)

This is where the single-policy framework matters. In Forcepoint, you:

1. Create a policy once—for example:
   • “Highly Confidential files must not be shared externally or uploaded to unsanctioned AI or cloud apps.”
2. Enforce it everywhere:
   • SharePoint, OneDrive, Teams, and file servers (discovery and access control)
   • Cloud apps (via CASB/inline controls)
   • Web and email (DLP)
   • Endpoints and network

Because classification tags are persistent, the same sensitivity label follows the file across channels. That enables Data Detection and Response (DDR): you can not only see where data is stored, but also how it moves—and intervene before a breach happens.

What you’ll see:

• Consistent policy hits and enforcement actions across channels
• Fewer false positives, because classification is context-aware
• Unified dashboards for:
  • Data at rest (where it’s stored)
  • Data in motion (where it’s going)
  • Data in use (what users are doing with it)

---

Step 7: Operationalize for compliance, AI adoption, and executive visibility

Boards and regulators don’t want raw scan outputs; they want evidence that you have genuine visibility and control.

With Forcepoint, compliance and security teams can:

• Use out-of-the-box policy templates (nearly 2,000) for:
  • PCI DSS, HIPAA, GDPR, CCPA, and other global regulations
  • Country-specific ID formats and financial data
  • Sector-specific requirements (financial services, healthcare, public sector)
• Generate centralized reports:
  • Locations and volumes of regulated data across SharePoint, OneDrive, Teams, and file shares
  • Exposure trends over time (external sharing, public links, over‑permissioned files)
  • Remediation actions taken and residual risk
• Support DSAR and eDiscovery workflows:
  • Search for a data subject across cloud and on‑prem repositories
  • Prove where their data is stored and how it’s protected

For AI adoption, the same visibility and controls help you:

• Allow safe use of tools like ChatGPT, Microsoft Copilot, and other LLMs
• Automatically prevent sharing of sensitive data to external AI or unauthorized internal users
• Demonstrate to stakeholders that “AI moves fast, but our data isn’t moving uncontrolled”

What you’ll see:

• Executive dashboards summarizing:
  • Total sensitive data footprint across Microsoft 365 and on‑prem file shares
  • External and internal exposure, before and after remediation
  • Top risk reductions achieved by policy
• Clear narratives you can take to the board:
  • “Here’s where our sensitive data was.”
  • “Here’s how it was exposed.”
  • “Here’s what we did, and what we’re monitoring continuously.”

---

How Forcepoint specifically helps you answer the “where is our sensitive data?” question

Forcepoint’s Self-Aware Data Security is designed to close the execution gap between visibility and control:

• Continuous discovery across SharePoint, OneDrive, Teams, on‑prem file shares, databases (Microsoft SQL, Oracle, MySQL), and data lakes (Snowflake, Databricks)
• AI Mesh Data Classification using an explainable SLM and large template library to tag sensitive data accurately across structured and unstructured estates
• Exposure analytics to:
  • Identify publicly shared, externally shared, and overshared files
  • View individual user access per file and see who has access to the most files
• Automated remediation:
  • Adjust permissions
  • Prevent oversharing
  • Move/quarantine mislocated data
  • Clean up ROT and duplicates
• Single-policy framework so you can create once and enforce everywhere: SaaS, email, web, endpoints, networks, clouds, and AI tools
• Risk-Adaptive Protection and DDR to dynamically adjust controls based on sensitivity, behavior, and context

It’s the same approach trusted by more than 12,000 customers in 150+ countries, including large enterprises and government agencies that can’t afford blind spots.

---

Final decision framework

If your goal is to find where sensitive data is stored across SharePoint, OneDrive, Teams, and on‑prem file shares—and then actually reduce risk—use this framework:

1. Unify discovery across Microsoft 365 and file servers in one console
2. Classify with explainable AI, not just regex and keywords
3. Map exposure: public, external, and internal oversharing, plus who has access
4. Prioritize by risk, combining sensitivity, exposure, and user behavior
5. Remediate at scale, with automated permission repair, relocation, and ROT cleanup
6. Enforce single policies everywhere, following the data across web, email, endpoints, SaaS, and AI
7. Report and prove control, using templates and dashboards aligned to regulations and board expectations

That’s how you move from “we think we know” to a defensible, measurable answer to where your sensitive data lives—and how well it’s protected.

---

Next Step

Get Started