m365-govern-manage

Name: m365-govern-manage
Author: vinayaklatthe

161stars34forks

How to install m365-govern-manage?

vinayaklatthe/microsoft-security-skills/m365-govern-manage

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill m365-govern-manage

Installs into the current project.

Summary

Guidance for governing and managing Microsoft 365 collaboration sprawl — Teams/group lifecycle, sharing and guest access governance, and SharePoint Advanced Management — to keep the data estate secure and Copilot-ready. WHEN: Microsoft 365 governance, Teams sprawl, group lifecycl

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Governance & Management
2
3	Uncontrolled collaboration sprawl - orphaned Teams, broad sharing, stale guests, overshared
4	sites - increases data risk and is the #1 blocker to a safe Microsoft 365 Copilot rollout.
5	This skill governs the Microsoft 365 collaboration estate without strangling productivity.
6
7	## When to use
8	Use this skill when the user is preparing for Copilot, dealing with sprawl from years of
9	open-by-default Teams creation, or building a long-term collaboration governance programme.
10
11	Do not use this skill for:
12	- DLP policy design (use `purview-dlp-policy`)
13	- Sensitivity label classification (use `purview-data-classification`)
14	- Copilot-specific oversharing remediation (use `purview-copilot-oversharing`)
15	- Entra access reviews for app/role access (use `entra-id-governance`)
16
17	## Pick the right control for the symptom
18
19	\| Symptom \| Control \| Required licence \|
20	\|---\|---\|---\|
21	\| Anyone can create Teams; hundreds of orphaned groups \| M365 group creation restriction + naming + expiration policy \| Entra ID P1 (for expiration) \|
22	\| Guests added years ago still in groups \| Entra access reviews for guests \| Entra ID P2 \|
23	\| Sites shared with "Everyone except external users" by default \| SharePoint default sharing link = People in org \| M365 E3+ \|
24	\| Site contains sensitive data + open sharing \| Restricted Access Control (RAC) + sensitivity label \| SAM (E5 + SAM add-on) \|
25	\| Cannot see which sites overshare sensitive data \| SAM Data Access Governance reports \| SAM (E5 + SAM add-on) \|
26	\| Inactive sites cluttering tenant \| SAM inactive-site policy + site lifecycle \| SAM (E5 + SAM add-on) \|
27	\| Teams chat retention going forever \| Retention policy (forward-only) \| M365 E3 + \|
28	\| Need to block Copilot from indexing a site \| Restricted Content Discovery (RCD) \| SAM (E5 + SAM add-on) \|
29
30	> Rule of thumb: governance for sprawl follows **discover → tighten defaults → clean up
31	> existing → maintain**. Skip discovery and you tighten the wrong controls.
32
33	## Approach
34
35	1. Measure the sprawl first — Run the SharePoint Admin → Active sites report and the
36	SAM Data Access Governance reports to quantify:
37	- Sites > 12 months inactive
38	- Sites with > 1000 unique permissions
39	- Sites shared with "Everyone except external users" or anonymous links
40	- Teams without an owner
41
42	Use the numbers to size the programme and pick first targets.
43	*Verify: you can name your top 20 oversharing sites and your orphan-team count before
44	designing any policy.*
45	2. Tighten defaults before cleaning up — Otherwise sprawl regrows.
46	- Default sharing link = People in your organisation (not Anyone with the link)
47	- External sharing = Existing guests or New and existing guests (not Anyone)
48	- Group creation = restricted to a security group of approved owners (everyone else
49	requests via a form)
50	- Naming policy = prefix/suffix by department, blocked words list
51	- Expiration policy = 365 days with owner renewal
52	*Verify: a test user without rights cannot create a new M365 group; default link on a new
53	site is People in your organisation.*
54	3. Apply container labels — Sensitivity labels at the site/team/group container level
55	enforce privacy, external sharing, unmanaged-device access, and conditional access
56	automatically. Critical for sites Copilot will see.
57	*Verify: a labelled site rejects guest sharing if the label forbids it; CA policy fires
58	on access from unmanaged device.*
59	4. Clean up existing sprawl in waves — Do not bulk-revoke; user backlash kills the
60	programme. Sequence:
61	- Wave 1: archive inactive sites (no edits in 18+ months) - read-only first, delete after
62	90-day grace
63	- Wave 2: review oversharing on sites containing labelled sensitive data
64	- Wave 3: guest access reviews per group, owner-driven
65	- Wave 4: ownerless groups assigned or archived
66	Verify: per-wave dashboard shows targets reduced > 50% with < 5% legitimate appeals.
67	5. Run a permanent review cadence — Once-and-done fails. Schedule:
68	- Quarterly: guest access reviews on sensitive groups
69	- Monthly: ownerless-group sweep
70	- On expiration: owner reaffirms or group deletes
71	6. Report on posture — Build a SharePoint Admin + SAM workbook showing oversharing trend,
72	guest count, ownerless-group count. Make sprawl visible to leadership monthly.
73
74	## Guardrails
75	- **Governance und

People who liked this also viewed

6 picks

Type

m365-govern-manage

161stars34forks

View on GitHub

How to install m365-govern-manage?

vinayaklatthe/microsoft-security-skills/m365-govern-manage

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill m365-govern-manage

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft 365 Governance & Management
2
3	Uncontrolled collaboration sprawl - orphaned Teams, broad sharing, stale guests, overshared
4	sites - increases data risk and is the #1 blocker to a safe Microsoft 365 Copilot rollout.
5	This skill governs the Microsoft 365 collaboration estate without strangling productivity.
6
7	## When to use
8	Use this skill when the user is preparing for Copilot, dealing with sprawl from years of
9	open-by-default Teams creation, or building a long-term collaboration governance programme.
10
11	Do not use this skill for:
12	- DLP policy design (use `purview-dlp-policy`)
13	- Sensitivity label classification (use `purview-data-classification`)
14	- Copilot-specific oversharing remediation (use `purview-copilot-oversharing`)
15	- Entra access reviews for app/role access (use `entra-id-governance`)
16
17	## Pick the right control for the symptom
18
19	\| Symptom \| Control \| Required licence \|
20	\|---\|---\|---\|
21	\| Anyone can create Teams; hundreds of orphaned groups \| M365 group creation restriction + naming + expiration policy \| Entra ID P1 (for expiration) \|
22	\| Guests added years ago still in groups \| Entra access reviews for guests \| Entra ID P2 \|
23	\| Sites shared with "Everyone except external users" by default \| SharePoint default sharing link = People in org \| M365 E3+ \|
24	\| Site contains sensitive data + open sharing \| Restricted Access Control (RAC) + sensitivity label \| SAM (E5 + SAM add-on) \|
25	\| Cannot see which sites overshare sensitive data \| SAM Data Access Governance reports \| SAM (E5 + SAM add-on) \|
26	\| Inactive sites cluttering tenant \| SAM inactive-site policy + site lifecycle \| SAM (E5 + SAM add-on) \|
27	\| Teams chat retention going forever \| Retention policy (forward-only) \| M365 E3 + \|
28	\| Need to block Copilot from indexing a site \| Restricted Content Discovery (RCD) \| SAM (E5 + SAM add-on) \|
29
30	> Rule of thumb: governance for sprawl follows **discover → tighten defaults → clean up
31	> existing → maintain**. Skip discovery and you tighten the wrong controls.
32
33	## Approach
34
35	1. Measure the sprawl first — Run the SharePoint Admin → Active sites report and the
36	SAM Data Access Governance reports to quantify:
37	- Sites > 12 months inactive
38	- Sites with > 1000 unique permissions
39	- Sites shared with "Everyone except external users" or anonymous links
40	- Teams without an owner
41
42	Use the numbers to size the programme and pick first targets.
43	*Verify: you can name your top 20 oversharing sites and your orphan-team count before
44	designing any policy.*
45	2. Tighten defaults before cleaning up — Otherwise sprawl regrows.
46	- Default sharing link = People in your organisation (not Anyone with the link)
47	- External sharing = Existing guests or New and existing guests (not Anyone)
48	- Group creation = restricted to a security group of approved owners (everyone else
49	requests via a form)
50	- Naming policy = prefix/suffix by department, blocked words list
51	- Expiration policy = 365 days with owner renewal
52	*Verify: a test user without rights cannot create a new M365 group; default link on a new
53	site is People in your organisation.*
54	3. Apply container labels — Sensitivity labels at the site/team/group container level
55	enforce privacy, external sharing, unmanaged-device access, and conditional access
56	automatically. Critical for sites Copilot will see.
57	*Verify: a labelled site rejects guest sharing if the label forbids it; CA policy fires
58	on access from unmanaged device.*
59	4. Clean up existing sprawl in waves — Do not bulk-revoke; user backlash kills the
60	programme. Sequence:
61	- Wave 1: archive inactive sites (no edits in 18+ months) - read-only first, delete after
62	90-day grace
63	- Wave 2: review oversharing on sites containing labelled sensitive data
64	- Wave 3: guest access reviews per group, owner-driven
65	- Wave 4: ownerless groups assigned or archived
66	Verify: per-wave dashboard shows targets reduced > 50% with < 5% legitimate appeals.
67	5. Run a permanent review cadence — Once-and-done fails. Schedule:
68	- Quarterly: guest access reviews on sensitive groups
69	- Monthly: ownerless-group sweep
70	- On expiration: owner reaffirms or group deletes
71	6. Report on posture — Build a SharePoint Admin + SAM workbook showing oversharing trend,
72	guest count, ownerless-group count. Make sprawl visible to leadership monthly.
73
74	## Guardrails
75	- **Governance und

People who liked this also viewed

6 picks

Type