# HTML report administration checklist

Version 1.0 · Updated 23 October 2026 · A planning aid with partial tenant observations; not a completed security assessment.

In the episode lab, Allow HTML files was On, the Site AI main agent was Copilot, Show Copilot button to site visitors was On, and Share credits for advanced autofill columns was Off. These were read-only observations. Exact author entitlement, actual credit consumption, ordinary/restricted reader access and governance enforcement were not established. The report move and core rendering were tested; cross-site portability was not.

| Check | Record before wider use |
| --- | --- |
| Availability | Exact Copilot experience and observed controls on the intended site; separate HTML generation from the newer HTML page rollout |
| Author | Actual Copilot entitlement, site/list rights and output-library rights |
| Viewer | Page/report permission, source-list permission and observed result under the viewer's identity |
| Data copies | Import CSV/XLSX in Site Assets; text/data embedded in HTML; exported/downloaded versions |
| Audience | Required business access. Hiding fields or selecting a tab is not security |
| Location | Original and current URL, library, owner, dependencies, version and publishing state |
| Move | Destination permissions, existing links, source references, assets and refresh after move |
| Refresh | Source change → reopen → observed new result, including failure or stale-data state |
| Controls | Site AI, Restricted Content Discovery, Site Pages File types and allowed link domains; exact role and values |
| Cost | Spending-policy scope, limits, alerts and actual credit prompts/usage; do not assume every large request is included |
| Governance | Applicable retention, labeling, DLP, audit and ownership requirements; confirm actual artifact support and enforcement |
| Accuracy | Full record count, missing values, metric definitions, filters, duplicates and reconciliation |

Store the report where its intended readers already have the appropriate access, then test with their roles. Separate reports or a governed reporting solution may be needed where audiences require different data entitlements. Do not package confidential finance data into a shared HTML file and rely on a hidden tab to protect it.

A move is not a guarantee of portability. Retest the destination, links and source connection; keep a recoverable original. A downloaded HTML file may have different capabilities and may carry copied information outside SharePoint's access boundary.

Authoritative starting points: [Copilot administration](https://learn.microsoft.com/en-us/sharepoint/copilot-in-sharepoint-get-started), [HTML page requirements](https://support.microsoft.com/en-us/sharepoint/create-edit-publish-html-pages), [Microsoft's HTML page announcement](https://techcommunity.microsoft.com/blog/spblog/publish-rich-and-interactive-content-with-html-pages-in-sharepoint/4565918).