What should a Microsoft 365 governance plan include?

An inventory of teams, sites, guests, licences and agents; an owner for each; rules for creation, naming, guest access, sharing and labels; a lifecycle for inactive spaces; and a record of who decided what. It should also say who owns governance after go-live and how often the rules are reviewed. Keep it short enough that owners read it, and let tools check it every day.

Who should own Microsoft 365 governance?

One named owner on the IT side, working with security, compliance and business representatives. IT runs the tools and the rules, but day-to-day decisions belong to the owners of each team, site or agent, because they know the content. A small group that meets on a schedule you set handles new requests, exceptions and Microsoft changes.

How often should teams and sites be reviewed?

It depends on the risk, so set it per type of space. Sites with sensitive data or guests deserve a shorter cycle than internal project teams. Microsoft's inactive site policies email owners monthly, and a site an owner confirms is not checked again for a year. A Microsoft 365 group expiration period must be at least 30 days, and active groups renew automatically.

Do we need Microsoft 365 governance in place before rolling out Copilot?

You need the basics. Copilot only shows people content they can already open, so overshared sites become easier to find once it is live. Fix ownership, guest access and the worst oversharing first, and label sensitive content, as part of Copilot readiness. Restricted Content Discovery can keep a site out of Copilot while you work on it, but Microsoft presents it as a temporary measure.

Which Microsoft 365 governance controls need a Microsoft Entra ID P1 licence?

The group naming policy, the Microsoft 365 group expiration policy and the restriction of group creation to one security group all need Microsoft Entra ID P1. Sensitivity labels on teams and sites need at least one active P1 licence in the tenant. Basic access reviews need Microsoft Entra ID P2, and reviews focused on inactive users need Microsoft Entra ID Governance.

Can Microsoft 365 governance run on automation alone?

No, and it should not. Automation is good at finding what breaks a rule, reminding owners and carrying out a decision once it is made. Whether a team is still needed, whether a guest still works with you and which exceptions are acceptable are decisions for people who know the content. Start new rules in report mode before they act.

Microsoft 365 governance best practices

Microsoft 365 governance best practices are the rules and habits that keep teams, sites, guests, licences and agents owned, reviewed and tidy. They decide who may create what, who may share with whom, and what happens when something is no longer used. Start with an inventory, then fix ownership, guest access and sharing before anything else.

Most tenants grew without a plan. Teams were created for a project and never closed, sites were shared widely to get work moving, and guests were invited for one meeting and stayed. That mattered less when people had to know where a file lived to open it. Microsoft Copilot (formerly Microsoft 365 Copilot) changes this: it only shows people content they can already open, so overshared content becomes easier to find.

Below are nine practices in the order we apply them, with the Microsoft 365 control that helps and what you still have to follow up. To compare what each Microsoft admin tool does with what a governance layer adds, see the native tools comparison on our Microsoft 365 governance page.

What does Microsoft 365 governance cover?

Microsoft 365 governance is the set of rules, owners, checks and records that keeps collaboration in your tenant under control. The admin centres hold the settings; governance makes sure the rules behind them are followed every day, by the people who own the content. It is not a one-off project. Our Microsoft 365 governance page explains how we put it in place.

Where should you start?

Start with an inventory, not a policy document. You cannot set sensible rules until you know how many teams and sites exist, who owns them, who outside the organisation can reach them, and which licences and agents are in use.

Microsoft gives you useful starting points:

Data access governance reports in the SharePoint admin center show where sites may be overshared. They are part of SharePoint Advanced Management, which is available once at least one user has a Microsoft Copilot licence.
The last sign-in date in Microsoft Entra ID shows which accounts, guests included, have not been used for months.
The agent registry in the Microsoft 365 admin center lists the agents available in your organisation.

Then rank what you find by risk, not by volume: three hundred idle teams are clutter, but one site holding salary data and open to the whole company comes first. After that, work through the practices in this order:

Name an owner, and a backup, for every team and site
Decide who can create teams and groups, and how they are named
Decide how guests get in, and when their access ends
Find and fix oversharing, starting with sensitive sites
Label sensitive content and the containers that hold it
Clean up inactive teams and sites with the owner's agreement
Reclaim licences from accounts nobody uses
Give every agent an owner, a purpose and a review date
Turn on audit, and agree who reads it

Which Microsoft 365 governance best practices matter most?

The ones that cut exposure fastest: ownership, creation rules, guests and sharing. Labels, clean-up, licences, agents and audit build on them.

1. Name an owner, and a backup, for every team and site

Every other practice depends on this one: reviews, renewals and clean-up requests all go to an owner. A single owner is fragile, because people change roles and leave, so ask for a second one on anything that holds business data. In SharePoint Advanced Management, site lifecycle management includes a site ownership policy that flags sites without enough owners and notifies the people you choose. For Microsoft 365 groups, the expiration policy (practice 6) lets you set a fallback email address for groups that have no owner left.

2. Decide who can create teams and groups, and how they are named

You have two broad options: let everyone create teams under clear rules, or restrict creation to a group of people. Microsoft Entra ID supports both.

A group naming policy adds prefixes or suffixes and blocks chosen words when people create teams or groups. It needs Microsoft Entra ID P1.
You can limit who creates Microsoft 365 groups, and so teams, to one security group. This setting needs Microsoft Entra ID P1.

Restricting creation to IT tends to move the work into a ticket queue. A middle path often works better: creation stays open, but each request records a purpose, two owners and a visibility. Many teams governance best practices start here, because a team created with an owner and a purpose is far easier to retire.

3. Decide how guests get in, and when their access ends

First, separate two settings. External access lets your users chat and meet with people in other organisations. Guest access adds an outsider to your directory and your teams, with access to their files.

Guest access is switched on for the whole organisation in the Teams admin center and narrowed per team with sensitivity labels. Removing a guest from a team does not delete their guest account. SharePoint can also make guest access to sites and OneDrive expire after a set number of days, but that does not delete the guest account and does not cover guests who had access before the setting was turned on.

Basic access reviews come with Microsoft Entra ID P2, and reviews focused on inactive users need Microsoft Entra ID Governance (licensing fundamentals). We cover the review process step by step in how to run a Teams guest access review owners actually answer.

4. Find and fix oversharing, starting with sensitive sites

This is where SharePoint governance and Copilot meet. SharePoint and OneDrive have four external sharing levels, from Anyone links to internal only. A site can be stricter than the organisation, never looser, so tighten the sites that hold sensitive data.

Inside the organisation, a SharePoint admin starts a site access review from a data access governance report. The site owner gets an email, fixes access on a dedicated review page and marks the review complete, and the admin sees the outcome and comments. Site access reviews cover SharePoint sites, not OneDrive.

While permissions are being fixed, Restricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing who has access. Microsoft describes it as a temporary control, so plan the clean-up, not only the switch. Our article on Copilot governance best practices covers what to do once Copilot is live.

5. Label sensitive content and the containers that hold it

Sensitivity labels in Microsoft Purview work at two levels. On files, when sensitivity labels encrypt content, Copilot respects each user's usage rights. On containers, a sensitivity label on a team can set it to private and stop owners adding guests. Changing the label later does not remove guests already in.

Keep the label list short, and agree which label contracts and HR files get by default.

6. Clean up inactive teams and sites with the owner's agreement

Microsoft offers two mechanisms, and they do different things:

A Microsoft 365 group expiration policy renews active groups automatically and asks owners to renew the others before they are deleted. It needs Microsoft Entra ID P1. A deleted group can be restored for 30 days.
Inactive site policies in SharePoint Advanced Management email owners each month. If nobody confirms the site after three notices, the site can be set to read-only and later archived. They cover SharePoint and Teams sites, not OneDrive.

Do not mix them up: expiration removes the group, while the site policy keeps the content but stops it changing. For business teams, read-only then archive is usually the safer choice.

7. Reclaim licences from accounts nobody uses

Licences stay assigned to people who left, changed role or never sign in. The last sign-in date shows which. Give Copilot seats a separate look: they are easy to forget when their holders move on.

8. Give every agent an owner, a purpose and a review date

Agents need the same discipline as teams and sites. Microsoft's building blocks:

Agent 365 lists every agent in one registry, including agents that have no Microsoft Entra identity. Access and identity controls apply to agents that have one.
Microsoft Agent 365, generally available since May 2026, is Microsoft's own control plane for agents. It is licensed per user.
In the Power Platform admin center, data policies control which connectors and knowledge sources agents may use, Managed Environments limit how widely agents are shared, and the inventory lists agents, apps and flows.

Use them to enforce simple rules: every agent has an owner and a purpose, agents shared with everyone get a second look, and unused agents are retired. Our explainer on what Microsoft Agent 365 covers goes further.

9. Turn on audit, and agree who reads it

Copilot interactions are recorded in the Microsoft Purview audit log, including which files were used. In SharePoint, change history reports show what changed on a site or in SharePoint settings over the last 180 days.

Which Microsoft 365 control helps with each practice?

Each practice has a native control that helps. The last column is what your own process still has to cover.

Microsoft 365 governance best practices and the controls that help

Practice	Microsoft 365 control that helps	What to follow up
Owner and backup for every team and site	Site ownership policy in SharePoint Advanced Management; fallback address in the group expiration policy	Who takes over when an owner leaves
Rules for creating teams and groups	Group naming policy and group creation restriction in Microsoft Entra ID (P1)	Requests handled fast enough to avoid workarounds
Guest access	Teams guest settings, SharePoint guest expiration, Microsoft Entra access reviews (P2, or ID Governance for inactive users)	A sponsor per guest and a review on a schedule you set
Oversharing	External sharing levels, data access governance reports, site access reviews, Restricted Content Discovery	Which sites were reviewed and what changed
Sensitivity labels	Microsoft Purview labels on files and on teams, groups and sites	Coverage of sites within Copilot's reach
Inactive teams and sites	Group expiration policy (P1); inactive site policies in SharePoint Advanced Management	What happens to the OneDrive of leavers, which neither policy covers
Licences	Last sign-in date in Microsoft Entra ID	A reclaim step before each renewal
Agents	Agent registry, Microsoft Agent 365, Power Platform data policies, Managed Environments and inventory	An owner, a purpose and a review date for each agent, and what happens when its owner leaves
Audit	Microsoft Purview audit log, SharePoint change history reports	A named reader and a trigger for action

What can you automate, and what stays human?

Automate the detection and the reminders; keep the decisions with the people who know the content. Group expiration and inactive site policies already email owners without anyone in IT pressing a button.

Good candidates for automation:

Spotting what breaks a rule: teams with no owner, guests who have not signed in for a period you set, sharing links with no expiry date, licences on disabled accounts
Sending the reminder to the right owner, and chasing when there is no answer
Carrying out a decision once the owner has made it: archive, set to read-only, remove a guest
Keeping the record of who decided what, and when

What should stay with people:

Whether a team or site is still needed
Whether a guest still works with you
Exceptions to a rule, and the reason for each
Your label scheme, and who may build and share agents

Start every new rule in report mode, look at what it would flag today, then let it act. A rule that removes content without asking does the most damage on its first mistake, and owners stop trusting the next one.

How do you keep governance running after the project?

Give it a named owner on the IT side, and a small group from security, compliance and the business that meets on a schedule you set.

Three habits help it last:

Review the rules themselves. A rule that flags hundreds of findings nobody acts on needs changing, not more reminders.
Track the trend. Ownerless teams and unlabelled sites should fall over time.
Watch Microsoft's changes. Restricted SharePoint Search, for example, is being retired in favour of Restricted Content Discovery. Someone has to read the change notes and adjust your setup.

Train owners as well as admins: a short request in plain language gets answered.

How Neptune helps

Neptune is an integrator. We select the governance tool that fits your tenant, implement it with your team, train your admins and owners, and stay with you afterwards: professional services during the engagement, then a customer success manager. The native Microsoft controls stay in place; we configure them and build on them. With the tools we integrate:

One inventory of teams, sites, apps, flows and agents, with the links between them, and policies for every type of object, ranked by severity
New teams and sites started from templates that set naming, visibility, owners and approvers
Owners who review access in Teams by a deadline, with each decision logged with its reason
Inactive teams archived after the owner is asked, and guests who have not signed in for a period you set shown to the team owner, who decides whether they stay
Anonymous links and external shares that never expire ranked by risk and sent to the owner, with oversharing also tracked in Teams, Power BI and Power Platform
Copilot seats held by disabled or inactive accounts found and reassigned, with licence and storage reports per team
Agents governed alongside the teams, sites and permissions they use
Fixes that run on a schedule or on each violation, with evidence exported for auditors

See how this fits together on our Microsoft 365 governance page, or talk to us about your tenant.

Microsoft 365 governance best practices: where to start and what to automate