Microsoft 365 Governance Framework — a fixed-fee accelerator from EPC Group
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
- Duration
- 4–6 weeks
- Team
- Senior architect named on the Statement of Work; engagement lead where the program size warrants it.
- How it is priced
- Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges.
What it is
The framework decides and configures the policies that keep Microsoft 365 governable: who may create a team or group and under what naming, how teams and sites are expired and archived, how guests and external sharing are permitted, what is retained and for how long. SharePoint site provisioning becomes a process with an owner instead of a button.
The configuration is applied in the tenant, not just written down, and the admin team is trained on operating it. The documentation names the decisions and their reasons so the next administrator does not undo them.
Who it is for
Organizations experiencing Teams sprawl or SharePoint permission chaos: thousands of teams nobody owns, sites shared externally without review, retention that nobody set.
Start here by size — Stand up the controls. Governance frameworks, security hardening and quick-starts for organizations that already run the platform and need it governed. The organizations EPC Group serves, and the ones it does not, are set out on the fit page.
Deliverables
Teams governance policies (naming, lifecycle, guest access)
Naming conventions, expiry and archival rules, and guest policies configured in the tenant.
SharePoint site provisioning process
Request, approval, template and ownership steps that survive staff turnover.
Group and team creation policies
Who may create, with what defaults, and how exceptions are handled.
External sharing and guest access configuration
Sharing settings matched to the data each site holds.
Retention and archival policies
Retention aligned to the organization's obligations and applied to the right locations.
Governance documentation and admin training
The decision record and two sessions for the administrators who will run it.
What is not included
- Clean-up of the existing sprawl at scale — the framework sets the expiry and archival rules; a backlog migration or deletion programme is scoped separately.
- Information-protection labelling and DLP design — see the Data Governance Assessment.
- Custom provisioning automation beyond the Microsoft 365 native process.
Anything outside the deliverables above is a change order under the Engagement Charter — written, priced and approved before the work starts.
When to start
- Team creation is open to everyone and the count has stopped being knowable.
- An external-sharing review found sites shared with the world.
- A retention obligation exists and nothing enforces it.
How it is priced
Fixed fee, quoted after a 30-minute scoping call. EPC Group does not publish price ranges. The scoping call is run by the architect who would lead the work; the fixed fee, the deliverables and the acceptance criteria are written into the Statement of Work, and the change-control, escalation and acceptance rules are the ones in the Engagement Charter.
Frequently Asked Questions
No team is deleted by the framework itself. Expiry policies notify owners and archive inactive teams on the schedule the organization sets; a clean-up of the historical backlog is scoped separately.
Book the scoping call
A 30-minute call with the architect who would lead the M365 Governance engagement; the fixed fee follows in writing.
Contact EPC Group