Why Sensitive Data Discovery Comes First
Sensitive data discovery is the first security assessment an MSP should run in any Microsoft 365 client environment. You cannot protect data you cannot find, and you cannot safely switch on Microsoft 365 Copilot over data nobody has mapped.
Most clients believe their sensitive data lives in a handful of known places: the finance SharePoint site, the HR folder, the line-of-business app. In practice it is scattered across years of OneDrive uploads, Teams chat attachments, email threads, and SharePoint sites created for a project that ended in 2021.
That gap between where data is supposed to live and where it actually lives is where breaches start. It is also where an AI assistant will go looking the moment a user asks it a question.
This guide gives MSP and MSSP security leaders a repeatable approach to data discovery and data classification in Microsoft 365: where to look, how to classify what you find, how to score risk, and how to package the work as a billable service.
Where Sensitive Data Hides in Microsoft 365
Sensitive data discovery is the process of locating, identifying, and inventorying regulated or business-critical information wherever it actually sits. In Microsoft 365, that means scanning five surfaces, not one.
- SharePoint Online. Contracts, financials, HR records, and client deliverables. These get missed because sites outlive projects, and permissions inherit and sprawl.
- OneDrive. Exported reports, ID scans, payroll spreadsheets, and personal copies of shared files. IT rarely reviews OneDrive because it's treated as "personal."
- Teams. Files shared in chats and channels, pasted credentials, and screenshots. Every Team and chat file lands in SharePoint or OneDrive behind the scenes.
- Exchange Online. Attachments with PII, bank details, and health information. Mailboxes are large and old, and nobody audits them proactively.
- Endpoints and file servers. Synced libraries, local downloads, and legacy shares not yet migrated. These sit outside the cloud tenant, so cloud-only tools never see them.
The last item matters more than most M365 assessments admit. A file deleted from SharePoint may still sit in a synced OneDrive folder on a laptop, or on the on-premises share the client "retired" two years ago. Effective sensitive information scanning covers the whole client environment, not just the tenant.
A Data Classification Taxonomy MSPs Can Standardize
Standardize one data classification taxonomy across every client so findings are comparable and reports are repeatable. Six categories cover most small and mid-sized businesses.
- Personally identifiable information (PII). SINs, SSNs, driver's licenses, passport numbers, and home addresses. Primary obligation: Privacy law (PIPEDA, GDPR, state privacy laws) and breach notification.
- Financial data. Credit card numbers, bank account and routing numbers, and tax records. Primary obligation: PCI DSS, contractual obligations, and fraud risk.
- Health information. Diagnoses, benefits claims, and medical leave records. Primary obligation: HIPAA and provincial health privacy acts.
- Intellectual property. Source code, product designs, pricing models, and M&A documents. The risk is competitive and contractual.
- Contracts and legal. Client agreements, NDAs, litigation files, and employment contracts. Primary obligation: confidentiality clauses and legal privilege.
Keep the labels simple for clients. Map these categories to three or four sensitivity tiers (for example Public, Internal, Confidential, Restricted) so a business owner can understand the result without a glossary. Credentials deserve special attention: they rarely trigger compliance alarms, yet a single password spreadsheet in a broadly shared folder can undo every other control.
The Sensitive Data Discovery Workflow
Run every engagement through the same seven steps. A fixed workflow keeps scope tight, makes delivery predictable, and lets junior engineers run discovery with senior review.
- Scope and authorize. Confirm which tenants, sites, mailboxes, devices, and file servers are in scope. Get written authorization and agree how findings containing sensitive data will be handled and stored.
- Inventory the estate. List every SharePoint site, Team, OneDrive, shared mailbox, and connected file share. Flag inactive, ownerless, and externally shared sites as you go; these are your likely hot spots.
- Configure detection. Enable the built-in sensitive information types that match the client's industry and jurisdiction. Add custom patterns for client-specific identifiers such as account numbers, patient IDs, or project codes.
- Scan and classify. Run sensitive information scanning across cloud and endpoint sources. Record what was found, where, how many instances, and the confidence of each match.
- Validate. Sample results by hand. Remove false positives (a 16-digit order number is not a credit card) and confirm true positives before they reach a client report.
- Correlate with access. Overlay findings with who can reach them: internal users, groups, guests, anonymous links, and connected apps. Data is only as risky as its exposure.
- Report and prioritize. Score each repository, rank remediation, and present results in business language with a clear owner for each fix.
Steps 6 and 7 are where most do-it-yourself assessments stop short. A list of files containing PII is interesting. A list of files containing PII that every employee and two former contractors can open is actionable.
Assessment Criteria for Scoring Risk
Score every repository on the same five criteria so clients see a ranked list, not a pile of findings. A simple 1 to 5 scale per criterion is enough.
- Sensitivity. Low risk is internal-only, non-regulated content. High risk is regulated PII, health data, or credentials.
- Volume. Low risk is a handful of matches. High risk is thousands of records or bulk exports.
- Exposure. Low risk is access restricted to a named group that needs it. High risk is org-wide, guest, or "anyone with the link" access.
- Staleness. Low risk is content that is actively owned and reviewed. High risk is ownerless, inactive, or untouched for 12+ months.
- AI reachability. Low risk is content excluded from Copilot and other AI connectors. High risk is content fully searchable by Copilot or a third-party AI app.
Multiply sensitivity by exposure for a quick severity score, then use volume, staleness, and AI reachability to break ties. A small folder of credentials shared org-wide outranks a large, locked-down HR archive.
AI reachability is the newest criterion and the one clients ask about most. Microsoft states that Copilot only surfaces content the user already has permission to see, so any file a user can open is a file Copilot can summarize for them. Overexposure that was once hidden by obscurity is now one prompt away.
Turning Data Discovery Into a Billable Service
Sensitive data discovery sells best as a fixed-scope assessment that leads into remediation and monitoring. Package it in three tiers so clients can say yes at the level they are ready for.
Tier 1: Discovery Assessment
A one-time scan of the M365 tenant plus endpoints and file servers, sold for a fixed project fee. Deliverables are a data map, a classification summary, a risk-ranked repository list, and an executive readout.
Tier 2: Remediation Project
Fixes for the top-ranked findings, scoped and priced per finding group. Work includes permission cleanup, link expiry, data deletion or relocation, and labeling.
Tier 3: Continuous Monitoring
Ongoing scanning and drift detection, billed as a recurring per-user or per-device fee. Deliverables are a monthly exposure score, new-finding alerts, and a quarterly business review.
Three principles keep the service profitable. First, keep the assessment scope fixed and the price published, so it is an easy first purchase. Second, make every finding a line item in a remediation proposal before the readout ends. Third, frame monitoring around change: new hires, new SaaS apps, and new AI tools reopen exposure every month, so a one-time snapshot ages fast.
The executive readout is the sales moment. Lead with two or three concrete findings, such as payroll exports in an org-wide folder or credentials in a guest-accessible Team. Specific evidence moves budget faster than a generic risk score.
Common Mistakes to Avoid
- Scanning only SharePoint. OneDrive, Teams chat files, mailboxes, and endpoints often hold the riskiest copies.
- Relying on labels that don't exist yet. Label-based reports miss everything nobody has labeled, which in most SMB tenants is nearly everything.
- Reporting matches without exposure. Data classification without access context produces long reports and little action.
- Skipping validation. One obvious false positive in a client readout undermines trust in every other finding.
- Treating discovery as one and done. The environment changes weekly. Without continuous monitoring, the data map is out of date within a quarter.
Start With Evidence
Clients are already asking whether they are safe to roll out Copilot. Sensitive data discovery gives you a defensible answer and a clear path to the remediation and monitoring work that follows.
Cavelo helps MSPs and MSSPs automate data discovery and classification across Microsoft 365, endpoints, and file servers, then map who can reach that data, all from a multi-tenant platform built for the channel. Talk with our team to see how to package sensitive data discovery as your next service line.
