Microsoft SharePoint Advanced Management (SAM) Data Access Governance (DAG) and DeliverPoint both help organisations understand SharePoint access, but they serve different governance needs. DAG gives administrators tenant-wide reports that help identify sites with potential oversharing or sensitive content. DeliverPoint gives authorised Site Owners and administrators detailed, actionable permission and sharing-link reports, with tools to remediate access—including bulk actions.
The choice is not necessarily one or the other. DAG can help an organisation identify where to investigate across its estate. DeliverPoint can help the people responsible for particular sites understand the details and make changes within their remit. The right approach depends on your licensing, governance model, scale and the work you need to do after a risk is found.
What is Data Access Governance in SharePoint Advanced Management?
Data Access Governance is a set of reports and related governance capabilities in SharePoint Advanced Management. It helps SharePoint administrators find sites that may be overshared or contain sensitive content. Depending on the report, administrators can review a current permissions snapshot, see sites with recent sharing-link activity, or identify broad access such as sharing with “Everyone except external users.” Some reports can also help locate specific content or support a Site Access Review.
This makes DAG useful for building a tenant-level picture of access risk. It can help an organisation prioritise which sites need attention, assess the scale of a potential issue, and connect findings to wider SharePoint Advanced Management controls and review processes. Available reports and actions can depend on licensing, roles, configuration and the specific report being used.
DAG is a valuable part of a governance programme, but a report that identifies a site or risk does not always give the relevant business owner a simple, ongoing way to examine all the underlying permissions and make the required changes. This is where a permissions management tool such as DeliverPoint can complement the administrator’s broader view.
What does DeliverPoint add for Site Owners?
Permissions are often closest to the work: a project changes, a colleague leaves, a partner no longer needs access, or a document is shared more widely than intended. Site Owners understand that business context, but they need a practical way to see who has access and respond without sending every question to central IT.
DeliverPoint enables authorised Site Owners to run permission reports on demand for the SharePoint content they manage. They can review access at site, list or library, folder and item level; see how users received access; and investigate sharing links. Reports can be filtered and exported, helping an owner answer questions such as: Who has edit access? Which files have unique permissions? Where are sharing links in use? Does this person still need access?
Once they have investigated, Site Owners can take supported actions on the selected permissions or links. DeliverPoint supports operations such as granting, revoking, copying, transferring or deleting permissions, and reviewing or removing sharing links. Bulk actions can reduce repetitive, item-by-item work, while the owner’s existing SharePoint rights and the organisation’s configuration determine what that person can report on and change.
This is a practical difference in day-to-day governance: Site Owners can review access when a business need arises, rather than relying only on a periodic tenant-wide report or raising a request for every site-level change. The aim is not to hand out unrestricted control. It is to let the people accountable for a site act within appropriate permissions and governance guardrails.
Administrators can schedule permission reports for Site Owners
Self-service reporting does not mean that every Site Owner must run every report themselves. SharePoint Administrators can configure and schedule DeliverPoint permission reports on behalf of Site Owners. Reports can be set to run on a recurring basis and made available to the appropriate people, supporting regular reviews as well as on-demand investigation.
Scheduled reports are particularly useful for large scopes, recurring audits or teams that want a consistent review rhythm. A Site Owner can receive a report relevant to their site, while administrators retain oversight of the reporting approach and can define who has access to the results. Scheduling requires the relevant DeliverPoint configuration and permissions.
How DeliverPoint and DAG compare
| Governance need | SharePoint Advanced Management Data Access Governance | DeliverPoint |
|---|---|---|
| Find potential oversharing across the tenant | Designed for organisation-wide discovery and prioritisation through DAG reports. | Can report across selected scopes, with permissions and sharing details that support investigation and remediation. |
| See recent sharing activity | Provides activity reporting for selected sharing patterns and time periods. | Reports current sharing links across selected sites and content, with details that help authorised users review and manage links. |
| Put access into business context | Can help administrators identify sites for follow-up and initiate governance workflows such as Site Access Reviews where available. | Gives Site Owners a direct role in reviewing access to the content they manage. |
| Investigate permissions in detail | Provides report-specific views and exports for its supported scenarios. | Provides contextual and advanced reports across sites and content, including how permissions were assigned and where permissions are unique. |
| Change permissions or sharing | SharePoint Advanced Management includes related controls and review capabilities; the available remediation depends on the feature and scenario. | Offers permission and sharing-link management actions, including bulk operations for authorised users. |
| Help Site Owners act | Site Access Reviews can involve Site Owners in review workflows. | Site Owners can run reports on demand and take supported actions within their permissions; administrators can also schedule reports for them. |
The tools are not direct substitutes. DAG is useful when administrators need a broad view of potential exposure and a way to prioritise governance work. DeliverPoint is useful when the organisation also wants detailed operational reporting and permission management available to Site Owners and administrators. Some organisations may use both: DAG to help find areas of concern, and DeliverPoint to help the responsible people investigate and make appropriate changes.
Why permissions and sharing matter for Microsoft 365 Copilot
Microsoft 365 Copilot works with information a user is already permitted to access. It does not make a private document public simply by being enabled, but it can make existing access easier to discover through natural-language questions and generated responses. If permissions are broader than intended, Copilot can make that overexposure more visible and consequential.
That is why permission and sharing reviews matter when preparing for Copilot. Organisations should understand who can access sensitive sites and files, check broad groups and external sharing, review old or unnecessary links, and make sure site ownership is clear. Reports help reveal where to look; effective governance also needs accountable owners and a workable process for remediation.
This work matters even if you are not rolling out Copilot. Employees, guests and collaborators can already find and use content they have access to through SharePoint, Microsoft Teams, OneDrive and Microsoft 365 search. Keeping access appropriate is part of protecting information, supporting compliance and avoiding unnecessary exposure—whatever AI plans you have.
DeliverPoint Hero Links reporting and management
Microsoft Hero Links introduce another sharing method for SharePoint files. DeliverPoint already includes Hero Links in its sharing governance capabilities, alongside standard sharing links. Administrators can report on Hero Links, review their scope, audience and permissions, and manage access where it no longer matches business requirements.
That matters because governance should account for the sharing methods people actually use. Bringing Hero Links into DeliverPoint’s reporting and management experience helps teams review them as part of their wider sharing process instead of treating them as a separate category to remember.
Read more about DeliverPoint 6.2: Hero Links and Orphaned Sites and our earlier introduction, The New SharePoint Hero Link.
Which should you choose?
Choose Data Access Governance when you need SharePoint Advanced Management reports to help administrators identify potential access risks across the organisation and prioritise governance follow-up. Choose DeliverPoint when you need Site Owners and administrators to examine permission details and act on them, including through on-demand reports, bulk operations and scheduled reporting.
If you are evaluating both, start with the governance questions you need to answer. Do you need an estate-wide view of where potential exposure exists? Do you need site-level owners to investigate and remediate access without routing every task through central IT? Do you need recurring reports delivered to owners? Your answers will show whether one capability is sufficient or whether the two can support different stages of the same governance process.
Frequently asked questions
Is DeliverPoint a replacement for SharePoint Advanced Management Data Access Governance?
No. They address related but different needs. Data Access Governance helps administrators discover potential access risks across SharePoint and OneDrive through report-specific tenant-level views. DeliverPoint focuses on detailed permission and sharing-link reporting and management for authorised users, including Site Owners. Organisations may use them together.
Can SharePoint Site Owners run permission reports in DeliverPoint?
Yes. Authorised Site Owners can run DeliverPoint reports on demand for the SharePoint content they manage. Their report scope and ability to make changes depend on their existing SharePoint rights and the organisation’s DeliverPoint configuration.
Can an administrator schedule DeliverPoint reports for Site Owners?
Yes. Where scheduled reporting is configured, SharePoint Administrators can schedule permission reports on behalf of Site Owners so they can receive recurring visibility into access for the sites they manage.
Can DeliverPoint change permissions in bulk?
DeliverPoint supports bulk permission and sharing-link management actions for authorised users. The actions available depend on the user’s permissions, the selected scope and the tenant configuration.
Does Copilot create SharePoint permission problems?
Copilot uses the permissions already in place. It does not inherently grant people new access, but it can make content they can already access easier to discover. Reviewing permissions and sharing is therefore an important part of Copilot readiness—and good governance even when Copilot is not in scope.
Does DeliverPoint report on Microsoft Hero Links?
Yes. DeliverPoint includes Hero Links reporting and management alongside standard Sharing Links, so administrators can review Hero Link scope, audience and permissions and take action when appropriate.
Continue reading
- SharePoint Advanced Management & Data Access Governance: Preparing SharePoint for the AI Era
- Copilot Doesn’t Create Your Permissions Problem. It Reveals It.
- DeliverPoint 6.2: Hero Links and Orphaned Sites
- The New SharePoint Hero Link
Take control of SharePoint permissions with DeliverPoint
Give SharePoint Site Owners a practical way to understand and manage access to the content they look after. Explore DeliverPoint or request a demo to see how on-demand reporting, scheduled reports and bulk actions can fit into your governance approach.
