Checklist: introducing Microsoft 365 governance
For: IT management and Microsoft 365 owners
Updated: 2026-11
Microsoft 365 governance is introduced in seven steps: take inventory, set rules for creating teams and sites, require at least two owners per team, review guest access regularly, classify sensitivity and retention, define a lifecycle with archiving and steer flows and apps through an approval process.
This checklist is for organisations whose Microsoft 365 environment has grown over years. It is especially urgent before introducing AI assistants that find all content a person can access.
Technical implementation is done with your own IT or provider; the checklist describes the rules and their evidence.
The checklist
- 01
Take inventory
Analyse teams, sites, guests, external sharing and Power Platform items.
Done when: A list shows teams without owners, inactive sites, inactive guests and flows of people who have left.
- 02
Regulate provisioning
Define who may create teams and sites, with which naming and required information.
Done when: The rule is documented and technically enforced; new teams follow the naming.
- 03
Require owners
Assign at least two responsible owners to every team and site.
Done when: No active team has fewer than two owners.
- 04
Steer guest access
Introduce rules for invitations and a periodic review of guest accounts.
Done when: A guest review has been carried out and the next date is set.
- 05
Classify
Agree sensitivity levels and retention rules with data protection and information security.
Done when: The levels are defined and applied to teams with confidential content.
- 06
Define lifecycle
Set rules for inactivity, archiving and deletion.
Done when: Inactive teams are put to owners for confirmation after a set period and otherwise archived.
- 07
Approve flows and apps
Introduce environments, data policies and an approval process for business-relevant flows and apps.
Done when: Business-relevant flows have an owner, documentation and a deputy.
Common mistakes
- —Blocking team creation entirely and thereby creating workarounds.
- —Never reviewing guest accounts.
- —Introducing AI assistants before permissions are cleaned up.
- —Running individuals’ flows without a deputy.
What this checklist does not cover
- —The checklist describes rules, not the concrete technical configuration, which differs by licence and environment.
- —Retention periods and archiving duties follow from applicable law and must be clarified legally.
- —Security configuration such as conditional access is a separate information security topic.
Parent service: IT Consulting
Matching offers
Microsoft 365 governance
We develop a governance concept for Microsoft 365: who may create teams and sites, how they are named, classified and archived, how guest access works, which retention and sensitivity rules apply and how Power Automate and Power Apps grow under control. With roles, policies and an implementation plan for your IT.
Workflow platform evaluation
We evaluate which platform should carry your approval and business processes: an inventory of existing flows, requirements gathered from the process, a comparison of Power Automate, third-party platforms, BPM engines and custom development against weighted criteria including lifetime cost, and a reasoned recommendation, as a HERMES study if required.
FAQ
Are additional licences needed?
Some features, such as automatic classification, require higher licences. Many rules can be implemented with existing ones.
Who should own governance?
Someone from IT together with data protection and a business representative.
How often is it reviewed?
Guest access and owners periodically, the rules themselves annually or after major changes.
More checklists
Checklist: writing an app brief
A good app brief describes the goal and user groups, the three to five most important flows, platform requirements, the necessary data and interfaces, requirements for operations and data protection, and measurable success criteria. It leaves the technical solution open and makes proposals comparable.
Checklist: a secure Microsoft 365 baseline configuration
A secure Microsoft 365 baseline covers seven points: multi-factor sign-in for everyone, few and specially protected administrators, legacy sign-in protocols disabled, restricted consent to third-party apps, active logging, SPF, DKIM and DMARC for your domains, and an independent backup of the data.
Checklist: submitting a bid for a public tender
Before submission, check seven points: deadline, place and form, completeness of all required documents, validity of evidence of suitability, a price sheet exactly per template without reservations, legally valid signatures, correctly labelled variants and proof of receipt.