Microsoft 365 Governance That Works for People
A new Team appears for every project. Files are copied into personal OneDrives because nobody can find the approved SharePoint site. Former staff retain access longer than they should. These are not simply housekeeping issues. They are the everyday signs that Microsoft 365 governance needs attention.
For UK businesses, schools and charities, Microsoft 365 has become the place where work happens: email, meetings, files, chat, forms, devices and sensitive information all sit within one connected environment. That convenience is valuable, but it also means a small gap in control can have a much wider operational or security impact.
Good governance is not about making Microsoft 365 difficult to use. It is about setting clear, proportionate rules so people can collaborate confidently while your organisation knows who has access, where data lives and what happens when circumstances change.
What Microsoft 365 governance really means
Microsoft 365 governance is the practical framework for managing how people, information, applications and collaboration spaces are used across your tenant. It combines technical settings with ownership, policies and everyday processes.
The technology matters, but governance cannot be left solely to IT. A policy that says staff must label confidential documents will fail if the labels are unclear, training is absent or the approved way to share a file takes longer than sending it through a personal account. Equally, an IT team cannot make sensible decisions about retention or access without input from finance, HR, safeguarding, legal, senior leaders and the teams that handle sensitive records.
The aim is simple: make the secure, compliant route the easiest route for staff to take.
Why governance becomes urgent
Most organisations do not begin with a poor Microsoft 365 setup. They begin with a sensible, quick deployment designed to help staff work. Over time, new starters arrive, departments adopt new apps, projects create extra Teams, suppliers need guest access and people find shortcuts under pressure.
Without agreed controls, this growth creates risk in four connected areas:
- Identity and access: accounts, administrator rights and guest access may no longer reflect current roles.
- Information protection: confidential files can be shared too widely, downloaded to unmanaged devices or retained indefinitely.
- Collaboration: Teams, SharePoint sites and Microsoft 365 Groups can multiply without clear owners or purpose.
- Compliance and resilience: retention requirements, audit evidence and recovery expectations may be unclear until an incident, request or inspection exposes the gap.
For a school or multi-academy trust, this might involve safeguarding information being stored in an unsuitable location. For a business, it could mean commercial documents are still accessible to a former employee or a contractor. In either case, the consequences extend beyond technical inconvenience. They can affect trust, productivity, regulatory obligations and leadership time.
Start with the risks that matter to your organisation
There is no single perfect governance model. A small professional services firm, a manufacturing business and a college will have different data, working patterns and compliance pressures. Trying to apply every available Microsoft control at once often causes confusion and resistance.
Start by mapping your important information and the way it moves. Identify where staff store sensitive records, how they share information externally, which devices they use, and which third parties require access. Then establish what would cause the greatest harm: unauthorised disclosure, loss of records, prolonged downtime, fraud, or a failure to meet a contractual or statutory obligation.
This risk-led approach helps you make sensible trade-offs. Requiring multi-factor authentication for all users is a strong baseline. Restricting access from unmanaged devices may be right for highly sensitive departments, but may need a carefully planned alternative for visiting staff, governors or field-based workers. Controls should protect the organisation without making legitimate work impossible.
Set a clear ownership model
Every key Microsoft 365 service needs a named business owner as well as a technical owner. The business owner decides the purpose of a Team, site or data set and approves who should have access. The technical owner configures controls, monitors alerts and provides support.
This is particularly important for collaboration spaces. A Team without an active owner becomes an orphaned space where membership and files continue to exist with no clear accountability. Set a process for creating Teams and SharePoint sites, naming them consistently, assigning at least two owners and reviewing them at defined points in their lifecycle.
Not every request needs a service desk ticket and a lengthy approval chain. Self-service can work well when it sits within guardrails. For example, staff may be able to create project Teams from an approved template that includes the right privacy setting, owners, channels and sensitivity label. The balance depends on your organisation’s size, risk appetite and internal capacity.
Build the controls people rely on every day
A well-governed tenant usually begins with identity. Use multi-factor authentication, reduce the number of global administrators and apply role-based permissions rather than giving broad access for convenience. Review privileged accounts separately and regularly. Administrator access is powerful, so it deserves stronger oversight than ordinary user access.
Joiner, mover and leaver processes also need to connect HR or management actions with technical changes. When somebody changes role, their access should change too. When they leave, their account, sessions, devices, mailbox and shared-file access need a managed process, not an informal reminder sent after their last day.
Data controls come next. Sensitivity labels can help staff distinguish between public, internal and confidential information, while encryption and sharing restrictions can add protection where it is justified. Data loss prevention policies can identify or prevent inappropriate sharing of selected data types. These tools are useful, but they need careful testing. An overzealous rule that blocks legitimate emails will quickly be bypassed or ignored.
Retention is another area where organisations need a deliberate decision. Keeping everything forever creates unnecessary exposure and makes information harder to find. Deleting too early may breach legal, financial, educational or contractual duties. Agree retention periods with the right stakeholders, document the rationale and make sure staff understand which systems are the official record.
Govern external sharing without stopping collaboration
External sharing is often where policy meets reality. Suppliers, parents, consultants, auditors and customers may all need information. A blanket ban can lead to shadow IT, while unrestricted sharing is rarely appropriate.
A better approach is to define who can invite guests, which domains are acceptable, what information may be shared and how long access should last. Review guest accounts periodically, particularly after projects finish. For higher-risk relationships, use a separate collaboration space with tightly controlled membership rather than adding external users to an internal Team by default.
The same principle applies to applications requesting access to Microsoft 365 data. Staff may connect useful tools to their account with a few clicks, but each consent can create a data and security consideration. Maintain an approval process for third-party apps, review existing permissions and remove applications that are no longer needed.
Make governance an operating rhythm, not a one-off project
A policy folder is not governance. The work continues as your people, services and risks change. Establish a regular review cycle that covers administrator roles, inactive accounts, guest users, Team and site ownership, external sharing, application permissions and security alerts.
For smaller organisations, this may be a focused quarterly review led by an IT partner and a senior internal contact. Larger businesses and trusts may need a governance group with representation from IT, information governance, HR, finance and operational leadership. The format matters less than clear accountability and follow-through.
Measure what gives leaders confidence. Useful indicators could include the percentage of accounts protected by multi-factor authentication, the number of Teams without owners, overdue access reviews, unmanaged devices accessing data, and the time taken to complete leaver actions. Numbers should prompt action, not become reporting for its own sake.
Training also deserves a permanent place in the plan. Staff do not need a technical lecture on every Microsoft 365 feature. They need practical guidance at the moments it matters: how to share a file with a supplier, how to recognise a suspicious sign-in prompt, where to store a project document, and what to do with confidential information. Short, relevant reminders are more likely to stick than an annual compliance exercise.
When outside support adds value
Internal IT teams often understand the organisation’s needs best, but they may not have time to continually assess Microsoft licensing changes, new security features and detailed configuration options. An experienced managed service partner can provide independent challenge, implement agreed controls and help turn policy into a workable service.
At Breathe Technology, this work is approached as part of wider cyber resilience and day-to-day support, rather than as a set of settings applied once and forgotten. The right support model should leave your leaders with clearer accountability, your IT team with useful capacity, and your staff with a simpler way to work safely.
The best next step is not to switch on every control available. Ask whether you can confidently answer three questions: who can access our important information, why do they need it, and how do we know that access is still appropriate? If the answer is uncertain, that is a practical place to begin.