This is part 3 in a series of posts about Office 365 Governance. The first post was about making use of the Weekly Office 365 Changes Digest. Doing so is an essential part of change management. The second was about the work of an Office 365 Governance Team. In this post, I will talk about the many kinds of governance questions a governance team could address. Which ones it actually addresses are determined by the team considering the needs and priorities of the business.

In no particular order, I present to you a selection of governance questions for you to ponder.

Admin Account Governance

Governance policies for Office 365 Administrative Accounts address the following questions:

Should accounts with administrative privileges have usernames that follow a particular naming convention? For example, prepending the prefix “admin-” to an administrator’s regular user account name. For example, if the administrator’s regular account is jsmith, his or her admin account would be admin-jsmith.
What rules should be defined, communicated, and enforced about appropriate usage of admin accounts?
1. Guidelines I’ve seen used include:
  1. Use your admin account for any activity that requires elevated permissions
  2. Use your regular (non-admin) account for regular work (e.g. knowledge worker work, as opposed to system administration)
2. Just-in-time permission granting to admin accounts is ideal but beyond the capability of many organizations. Separating admin accounts from regular accounts is the next best thing. Use of multiple web browsers can make it easier to segregate one’s non-admin identity from one’s admin identity. For example, use one web browser for non-admin work, another for admin work on your production Office 365 tenant, and a third browser for work on your dev/test Office 365 tenant.
Who needs to have an admin account and what level of administrative permissions are needed, including in the Office 365 Admin Portal, the Security and Compliance Center, and in Azure AD?
1. For example, what admin permissions does the helpdesk need to have? Who should have full Global Tenant Admin rights versus who should have one or more granular admin perissions?
Should there be consistency between admin rights in your on premise AD environment and your SaaS environments? For example, if your SharePoint admin(s) is/are responsible for both SharePoint on premise and SharePoint Online, do they use the same admin accounts for both?
What Office 365 licenses should admins have, if any? The needs can depend on what services they administrate.

SharePoint Site Governance

Who gets to create a site?
Should there be a workflow or approval process for site creation?
Which site templates will be permitted?
What do we need to know about every site in our environment?
How do we avoid abandoned sites? Is it important to?
Do we need to backup our SharePoint Sites?
How do we manage access to our sites?
What do we expect of site owners?
What rules do we have about external access to sites?
How many site owners must a site have?
How do we handle site owner training?
How do we handle site owner transition?
What compliance or regulatory requirements affect our use of SharePoint?
How does Microsoft Teams affect our usage of SharePoint?
How do Hub Sites affect our use of SharePoint?
Do we customize the access request process?

OneDrive Governance

Do we allow external sharing?
If we allow external sharing, how often do we review who has access?
What compliance or regulatory requirements affect our use of OneDrive?
Who is responsible for applying legal holds?
What is appropriate usage of OneDrive at our organization? How is that being communicated to users?
What OneDrive training needs to be provided to managers regarding when one of their direct reports leaves the organization and they get notified about access to the user’s OneDrive?

Information Governance/ Data Governance

What policies procedures and settings do we put in place to manage sensitive information (social security numbers, PHI, customer lists, etc) and compliance requirements?
What do we do regarding records management?
What are our policies about document retention as they apply to SharePoint and OneDrive?

Microsoft Teams Governance

Who can create a Team?
Do we limit or monitor Team creation? For example, one organization I work with does not limit Team creation, but monitors it so that every time a new team is created, IT staff reach out to the creators to offer training.
Do we put a Team expiration policy in place?
Do we force Teams or their underlying Groups to make use of a naming convention prefix?

Service Configuration Process Governance

What changes made in the Office 365 Admin portal should be under strict change control?
Which changes in the Office 365 Admin portal should not be under change control?

For example, user management changes done through the Office 365 Admin Portal are not considered subject to change control. However, changes that disable or enable application access for all users would be under change control. Changes that control what applications are available for the end user to download may or may not be under change control. It’s again up to the Governance team to decide that.

General Usage Governance

It’s up to the governance team to determine what “When to use what” advice to provide to end users. For example, when to use Teams versus Yammer or Sway versus PowerPoint? The answers depend on the organization as much as they depend on the use case. For example, the difference in use cases for Teams and Yammer is more significant with a larger organization (for example, 3000 users) as opposed to a small organization (15 users).

Other questions on general usage include:

How often do we monitor usage of a given workload?
How is success of our adoption efforts measured?
Do we integrate with the HR Onboarding process and provide O365 training to new employees?

License Governance

There are a variety of licenses for Office 365 and related product services.

Which license or licenses do we use?
What rules do we put in place to guide which users get which licenses? For example, a mix of E3 and F1 licenses is not uncommon. How do we determine who gets which kind?
Are there license options that need to be adjusted when a license is assigned a user?
Is license assignment automated as part of an automated user provisioning process?
Are licenses reclaimed when a user leaves the organization?
Who makes decisions about license purchases?
Do you buy your licenses monthly or annually? From Microsoft or a reseller?

Conclusion

At times, governance of Office 365 can seem overwhelming. There certainly are enough choices to make. If you find yourself so overwhelmed by the choices, don’t panic. Prioritize the aspects of governance that are important to your organization. If you need help, rely first on your governance team. Microsoft and Microsoft Partners can also provide assistance. Of course, it can also help to compare notes with your peers at other organizations. Join an Office 365 users group near you, or attend (in person or via web meeting) the Office 365 Adoption User Group (Chicagoland Chapter).