Microsoft data exposure
You know which files hold card numbers. Do you know who can open them?
In a typical tenant, 1Security's first scan finds thousands of files with card numbers, national IDs, credentials or health records - and a meaningful share of them sit behind anyone links, organization-wide sharing or external users. Knowing a file holds a card number is a report row. Knowing that 214 people, two OAuth apps and one AI agent can read it is a decision. 1Security detects 300+ sensitive information types with its own engine and lands every finding on the permission graph, so the map shows exposure, not just presence.
The problem
Presence is a report row. Reach is a decision.
Classic data discovery ends with a list: these files contain personal data, these hold credentials, these have health records. What it cannot answer is the question every regulator, auditor and incident commander actually asks: who could read them, today, through which grant? In the tenants we connect to, 20-40% of files with sensitive content carry no label, and an ordinary account can reach hundreds of thousands of files.
The blind spot is wider than text. Card numbers live in scanned contracts, photographed IDs and screenshots pasted into decks - places a text-only scanner never looks. 1Security runs OCR as part of the same scan, so the map covers what an attacker would actually read, on a Business Basic license, with nothing extra to deploy.
And the map stays private: content is streamed into analysis and discarded. Only the detection type, match count and confidence persist - the matched card numbers or IDs themselves are never written to the database.
In practice
From "we have sensitive data somewhere" to a ranked exposure list.
Everything below runs on read-only consent and standard licenses - first findings the same day.
- 01
Let the scan find the data
Connect read-only. 1Security's engine reads file and email content for 300+ sensitive information types - credit cards with checksum validation, national IDs, IBANs, credentials, health data - plus OCR for images and scans, each detection with a confidence level. Purview detections, where present, sync in alongside as a second opinion.
- 02
Read Sensitive Info as a reach table
Every detection type is a row with live counts of the files, emails, sites, groups, users and apps that can reach it. "4,120 files with card numbers, reachable by 1,900 users and 3 apps" is the shape of the answer, and every count is a click into the list behind it. The row is also a control: declare the type no-AI-access or no-access, and those counts become a live violations list with the declaration on record.
- 03
Filter to what is exposed
Open Files, filter to with sensitive info + anyone link, then + shared with organization, then + external users. Add a framework filter - GDPR, HIPAA, PCI-DSS, SOX - and a confidence bucket so the number you quote is high-confidence only. In most tenants the anyone-link cut alone is hundreds of files.
- 04
Fix where one action removes the most
Sort by reach and start at the top: expire the anyone links on sensitive files, remove organization-wide sharing on the payroll library, restrict the app or agent nobody remembers consenting. Each is a suggested automation with a live match count, staged behind a 72-hour review window.
What makes it work
Three parts of the platform behind the map.
The map is where two systems meet: the detectors and the permission graph.
Access management
Effective access resolved through nested groups, sharing links and inheritance - the "who can reach it" half of every exposure number.
Explore the feature →Reporting
Regulator-grade numbers with confidence buckets, framework filters, saved views and exports - the map as evidence, not just a screen.
Explore the feature →Copilot security
The AI side of the same map: which sensitive information types sit within each Copilot agent's reach, before a prompt finds out.
Explore the feature →
FAQ
Common questions.
Do we need Purview or a premium license?
No. The 300+ detectors are 1Security's own engine and run on Business Basic upward. If you do run Purview, its SIT detections and labels are synced in and shown side by side, and the files that have sensitive content but no label become one filter.
Does 1Security store our sensitive content?
No. File and email content is streamed into analysis and discarded; what persists is the detection type, match count and confidence bucket. The matched values themselves are never written to the database.
What about images and scanned documents?
Built-in OCR reads jpg, png, tiff and other image formats, plus images embedded in documents - with sensible limits: files up to 50 MB, the first 5 pages of a PDF, up to 10 embedded images per document.
How long until the map is useful?
Reach counts start filling the same day you connect. Large tenants scan in stages for weeks, but the highest-exposure files - anyone links on sensitive content - usually surface within hours, and the automations show their live match count before you grant anything.
The 1Security platform
Sensitive Data Exposure Map is just the beginning
Sensitive Data Exposure Map is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
See your exposure as a ranked list, not a scan report.
Connect read-only and watch detections land on the permission graph - the anyone links on card numbers and IDs first, the same day.
Or keep answering "who can reach it?" with a shrug.