Global – – October 12, 2026 -- CrowdStrike has made Falcon Data Security for SaaS generally available, starting with Microsoft 365 coverage across SharePoint, OneDrive and Copilot, with plans to add more SaaS applications over time.
Platform classifies PII, PHI and payment card data as files change
The product continuously discovers and classifies sensitive data as files are accessed, modified and shared. Out-of-the-box patterns cover personally identifiable information, protected health information and payment card data, and custom patterns can be added for business-specific content. A classification engine shared across SaaS, endpoint and cloud is meant to close policy gaps between disconnected tools.
Automated Microsoft Sensitivity Labels activate encryption and restrict AI access
Based on classification results, the product can apply and manage Microsoft Sensitivity Labels. Teams can simulate labeling policies before enforcement. Labels then trigger Microsoft 365 protections including encryption, access controls, sharing restrictions and watermarks, and can also restrict AI access.
The Copilot angle is exposure: Microsoft Copilot draws on information users are already authorized to access, so data that was once hard to find can surface through a single AI interaction. Labeling sensitive content limits what Copilot can reach.
Exposure context ranks risks such as anonymous links and external sharing
The product combines sensitive content with exposure and location context to flag files shared through anonymous links, data shared externally, overly broad access and regulated data stored in unexpected places. Findings feed into CrowdStrike Falcon Next-Gen SIEM, so analysts can pivot from a data risk into wider investigations alongside other security telemetry.
Falcon Privileged Access integration replaces standing SharePoint permissions with time-limited grants
Through integration with CrowdStrike Falcon Privileged Access, organizations can grant just-in-time access to a specific user or group from an authorized device. Access is removed automatically when the approved period ends, replacing standing access to sensitive SharePoint content.