Governance posture of a mature SharePoint Online tenant
Baseline from a first-30-day assessment. Six headline signals tell leadership where risk, cost and Copilot exposure sit today. Click any KPI for its definition, data source, threshold and remediation path.
Maturity by governance domain — baseline vs. 90-day vs. 6-month target
Scored 1–5 against the control catalog below. Lowest today: Copilot readiness, ownership & lifecycle, permissions.
Risk concentration by site type
Count of sites carrying each risk signal. One site can carry several.
SharePoint Online Governance & Administration SME — requirements mapped
Every responsibility and qualification in the role brief, and the section of this command center that exercises it. Click a row to jump there.
| Requirement | Type | Where it shows up | Section |
|---|
Environment assessment — inventory, age and prioritized findings
Inventory built from PnP PowerShell, Microsoft Graph and SharePoint Advanced Management data-access-governance reports, then scored. Findings are ranked by exposure × likelihood × Copilot amplification.
Site inventory by type
9,846 active sites, OneDrive excluded.
Sites created per year — and where provisioning stalled
Teams adoption drove the 2020 peak. Creation falls from 2024 as automated provisioning was retired and requests moved to a manual queue.
Prioritized findings
Evidence column cites the report or script that produced it. Click a finding for the full analysis and remediation.
| ID | Severity | Finding | Evidence | Remediation | Section |
|---|
Six-month modernization roadmap
Sequenced so the backlog and the highest Copilot exposure are handled first, controls are proven in simulation before enforcement, and repeatable work is documented and handed to support by month six.
Workstream timeline (weeks 1–26)
Click a workstream for scope, dependencies and exit criteria.
Governance standards — and how each one is enforced
A standard without an enforcement mechanism is a suggestion. Each row names the technical control, the evidence it produces, and the KPI that proves it is working.
| Domain | Standard | Enforcement | Evidence · KPI |
|---|
External sharing tiers — bound to sensitivity labels
The container label chosen at request time sets privacy, sharing ceiling, guest access, unmanaged-device access and default link type.
| Tier | Label | Sharing ceiling | Default link | Guests | Unmanaged devices | Extra controls |
|---|
Site provisioning — clearing the backlog and restoring automation
Governed self-service: every request is classified at intake, approved by policy rather than by inbox, and provisioned the same way every time with owners, label, sharing tier, hub and retention already set.
Backlog projector
Model how fast the queue clears. Adjust intake, manual capacity and how much is automated, and when automation comes back.
Request classes & service levels
Triage of the current queue. Standard classes go fully automated; exceptions keep a human approval.
| Class | Queue | Path | SLA |
|---|
Provisioning runbook — Azure Automation (PowerShell 7.4, managed identity)
Excerpt. The provisioning identity is the one place tenant-wide write is justified; it is non-interactive, certificate-free, monitored and scoped by Conditional Access for workload identities.
Site lifecycle with SharePoint Advanced Management
Inventory → inactivity detection → owner attestation → access recertification → read-only → Microsoft 365 Archive → approved deletion, with retention holds checked before anything is disposed of.
Inactive-site cohort — outcome funnel
Outcome of the first inactive-site policy cycle. Click a stage.
Lifecycle actions per month
Archive and deletion only begin after a full notification cycle and a retention check.
SharePoint Advanced Management policy register
Each policy is run in simulation or report mode first, then scoped, then enforced. Click a policy.
| Policy / capability | Scope | Action | Cadence | Status |
|---|
Permissions & sharing remediation
Eight years of collaboration leave broad grants, stale links, direct user permissions and broken inheritance behind. Remediation runs in waves, highest-sensitivity first, with owners in the loop and a rollback record for every change.
Active sharing links by type
From the SAM sharing-links data-access-governance reports.
Remediation burn-down — weeks 1–14
Org-wide-grant sites and Anyone links, planned vs. actual.
Remediation waves
| Wave | Target | Method | Owner involvement | Guardrail |
|---|
Microsoft Purview — sensitivity labels, DLP, retention, records and audit
Labels classify containers and content; DLP acts on what labels and sensitive-information types find; retention and records keep what the business and regulators require and dispose of the rest with a reviewable trail.
Sensitivity label taxonomy
Four parent labels, few sublabels. Container settings apply to sites, Teams and Microsoft 365 groups; item settings apply to files and email.
Label coverage — baseline and plan
Containers, files labeled by users, files labeled by auto-labeling policies.
DLP matches in simulation — 30 days
SharePoint and OneDrive matches by sensitive information type, before enforcement.
DLP policy register
| Policy | Locations | Condition | Action | Mode |
|---|
Retention, records & audit
| Control | Type | Scope | Retention & disposition | Owner |
|---|
Microsoft Entra — least privilege for admins, support, automation and apps
No standing SharePoint administration. Human admins activate through PIM; automation runs as managed identities or certificate-bound apps limited to the sites they need with Sites.Selected.
Privileged roles — standing vs. eligible
Current state vs. target after PIM rollout.
Conditional Access for SharePoint administration and content
| Policy | Targets | Grant / session | State |
|---|
Applications and service principals with SharePoint access
Produced by Get-SharePointAppPermissions.ps1. Click a row for the decision record.
| Application | Permission today | Credential | Risk | Target |
|---|
Microsoft 365 Copilot & AI agent readiness
Copilot does not grant new access — it makes existing access instantly searchable and summarizable. Readiness is therefore permissions hygiene, labeling and lifecycle, gated before each licensing wave.
Exposure boundary — what an average employee can reach
Sites reachable through org-wide grants and files reachable through org-wide or Anyone links, projected by week.
Licensing waves & entry criteria
| Wave | Users | Entry gate |
|---|
Automation — PnP PowerShell, Microsoft Graph and SharePoint Online Management Shell
Inventory, permissions analysis, notifications and remediation run as scheduled, idempotent scripts with -WhatIf support and CSV evidence. Source is in the scripts folder of this repository.
| Script | Purpose | Modules / APIs | Auth model | Output |
|---|
Code
Authentication models
- Interactive admin
- Delegated, tenant-registered Entra app (the shared PnP Management Shell app was retired Sept 2024), PIM-activated role
- Scheduled jobs
- Azure Automation managed identity; no secrets to rotate
- Off-Azure jobs
- App-only with certificate in Key Vault; never client secrets
- Scoped apps
- Sites.Selected with per-site read / write / owner grants
- APIs
- Microsoft Graph v1.0 first; SharePoint REST and CSOM where Graph has gaps (role assignments, sharing links, tenant settings)
- Scale
- Graph
$batch, delta queries, honorRetry-Afteron 429/503
System KPIs and executive reporting
KPIs agreed with leadership and regional IT, each with a formula, a source of truth, a target and an owner. Power BI serves the executive view; operational reports go to site owners and the support team.
| KPI | Formula | Source | Baseline | Target | Cadence | Owner |
|---|
Six-month KPI trajectory
Plan of record. Actuals replace the projection as the monthly snapshots land.
Documentation, RACI, change control and support transition
Everything built is documented as it is built. Repeatable work moves to the support team through runbooks and knowledge articles, and high-risk changes follow one protocol across time zones.
Documentation set
RACI — governance decisions across Security, Legal, Privacy, Records, Audit and the business
R responsible · A accountable · C consulted · I informed
High-risk change protocol
Experience behind this model — Kenneth P. Barnes
Microsoft MVP (SharePoint, Project), former Microsoft Premier Consultant for Microsoft 365 and security, and 600+ SharePoint migrations. The controls on this page are the ones applied in that work.