Sites
See every place your data actually lives - every SharePoint site, Teams site, and personal OneDrive - and find the ones that are abandoned, wide open, or feeding your AI.
Sites
The Sites screen answers a question most organizations can't: "Where does our data actually live - and which of those places are wide open?" Every Team spawns a site. Every private channel spawns another. Every employee carries a personal OneDrive. Most tenants hold several times more sites than IT believes they have - and the ones nobody remembers are exactly the ones nobody is watching.
What You Can Achieve
Inventory the estate you actually have
Every SharePoint site, subsite, and hub, every Teams-connected site including private and shared channel sites, and every personal OneDrive - with owners, members, file counts, and storage in one list.
Find abandoned sites before attackers do
Sites with no owners, no users, or no activity for a year still hold data and permissions. They're unwatched attack surface - and stale food for Copilot answers.
Measure external exposure per site
Instead of auditing files one by one, rank whole sites by external users, sharing links, and anonymous access - and start where the blast radius is biggest.
Prepare sites for AI, deliberately
See which sites are Copilot-enabled and cross that with their sensitive info concentration - so you decide what AI reads instead of discovering it in a generated answer.
The Site Types That Matter
1Security distinguishes the site flavors Microsoft blurs together, because each carries a different governance story:
- Sites, subsites, and hub sites - classic SharePoint structure.
- Teams-connected sites - created implicitly whenever someone creates a Team; broken out further into standard, private, and shared channel sites, each with its own membership rules.
- Personal sites - every user's OneDrive. Corporate data in the thousands of "sites" nobody governs.
Access is split into direct users and indirect users (via groups) - so you can see not just how many people can enter a site, but through which doors.
The Site List
Each row summarizes a site's footprint and risk: members, owners, direct vs. indirect access, external users, groups with access, sharing links, Teams channels (including private and shared), drives, lists, subsites, storage size, sensitivity labels and detected sensitive info, whether Copilot is enabled, and an activity sparkline. Click a site to open its drawer and drill into its files, users, and activity. The drawer's Agents tab lists every AI agent that uses the site as a knowledge source (RAG grounding) - the answer to "if someone plants content here, whose answers does it reach?"
Two columns answer the question native admin views hide: Shared with everyone except external users and Shared with everyone (incl. guests). They are set when the site's root or one of its site groups carries SharePoint's built-in "Everyone" claims - the Members group of a public Team is the usual case - so every employee can open the site, its files appear in enterprise search and Copilot answers, and yet no user is listed by name. 1Security derives the flag at precompute time rather than listing every employee under the site, so member counts stay honest and the list stays readable.
Access status explains a fully scanned site that shows no content because Microsoft will not let anyone read it. Archived (no license) - a OneDrive whose owner holds no license that includes OneDrive; Microsoft makes it read-only after 60 days and archives it after 93, and assigning a OneDrive-bearing license reactivates it within 24-48 hours. Owner deleted - a OneDrive left behind by a deleted user. Locked - SharePoint refuses all access, usually an administrator's NoAccess lock or Microsoft 365 Archive. Deleted - the site no longer exists. Counts on these rows show "-" rather than 0: they are unknown, not empty. The column stays empty for readable sites and for sites still being scanned, and 1Security tries every such site again on each rescan.
The filter drawer narrows by site type, external exposure (including the two "everyone" claims above), orphaned indicators (no activity in the last year, no users, no owners), blocked status, scan coverage, the full sharing-link toolkit (scope, type, passwords, expiration), sensitive info presence, and the sites a specific user can access.
Select sites and choose Run actions to trigger automation workflows on them.
Investigative Patterns
The forgotten-but-open pattern: filter no activity in the last year + external users. Nobody inside touches these sites - but someone outside still can. This list is usually short, shocking, and immediately actionable.
- Pre-Copilot cleanup - Copilot enabled + with sensitive info, sorted by sensitive detections: the sites to label, restrict, or exclude before AI answers start quoting them.
- Anonymous doors - sites with anyone sharing links + sensitive info: whole containers reachable by URL alone.
- Company-wide doors - a site policy on Shared with everyone except external users + sensitive info: sites every employee can open without joining, whether SharePoint's "Everyone except external users" claim is granted on the site itself or sits in one of its groups - the Members group of a public team is the usual case.
- Ownerless data - no owners: nobody approves membership or reviews access for these sites. Assign owners or archive them.
Files
Answer the question every access review stalls on - who has access to our files, and why - for every user, link, app, and AI agent across Microsoft 365.
Groups
See what membership in any group actually unlocks - nested members, hidden external users, and the files and sites a single group grants access to.