What does a Microsoft 365 governance plan contain?

Six sections, each backed by a setting

Most governance documents EPC Group inherits from clients share a flaw: they describe intentions that no tenant setting enforces. The plan EPC Group writes instead has six sections, and each section ends with the name of the control that makes it true. Provisioning is enforced by the group-creation restriction. Naming is enforced by the Groups naming policy. Lifecycle is enforced by the expiration policy and archiving. External sharing is enforced by the SharePoint organization and site settings and by sensitivity labels on containers. Retention is enforced by Microsoft Purview retention policies and labels. Ownership is enforced by a calendar and a named person. The rest of this page walks through each section with the Microsoft documentation that defines the control, and it is the same structure EPC Group's Microsoft 365 consulting practice uses for a governance plan template, because a template without settings is a poster.

Section one: provisioning, or who can create what

Sprawl begins at creation. Microsoft states that by default all users can create Microsoft 365 groups, calls that the recommended approach because it lets people collaborate without IT, and then documents how to restrict creation to members of one particular group when business standards require it. The restriction affects every service that relies on groups for access, including Outlook, SharePoint, Viva Engage, Teams, Planner and Project, and it needs Microsoft Entra ID P1 or P2 licenses for the administrator who configures it and for the members allowed to create (Microsoft Learn, Manage who can create Microsoft 365 Groups, accessed 2026-10-20). Microsoft also notes that disabling SharePoint site creation does not remove users' ability to create groups or Teams, since a group creates a site (Microsoft Learn, Manage site creation in SharePoint, accessed 2026-10-20). EPC Group's plan therefore governs at the group layer, with a request form that records owner, purpose, audience and sensitivity, and a small group of trained creators who provision from it.

Section two: naming

A naming policy makes sprawl legible. Microsoft describes the Microsoft 365 Groups naming policy as a prefix-suffix rule built from fixed strings or user attributes such as department, plus a custom blocked-words list; it applies to the group name and alias across Outlook, Teams, SharePoint, Planner and Viva Engage, and it does not apply to Exchange distribution groups, which have their own policy (Microsoft Learn, Microsoft 365 Groups and Microsoft Teams naming policy, accessed 2026-10-20). EPC Group's default pattern encodes the business unit and the workspace type so that an administrator reading a list of 3,000 groups can tell a project team from a department from a client collaboration space without opening any of them.

Section three: lifecycle and expiration

Lifecycle is the section most templates leave blank. Microsoft documents a group expiration policy that sets a lifetime for Microsoft 365 groups: groups with user activity are renewed automatically, owners of inactive groups are notified to renew, groups not renewed are deleted, and a deleted group can be restored within 30 days. Only one expiration policy can be configured for all Microsoft 365 groups in an organization, and the feature requires the organization to possess Microsoft Entra ID P1 or P2 licenses for members of affected groups (Microsoft Learn, Configure the expiration policy for Microsoft 365 groups, accessed 2026-10-20). Renewal notifications go to owners 30, 15 and 1 day before expiration (Microsoft Learn, Microsoft 365 Groups overview for administrators, accessed 2026-10-20). For Teams, Microsoft adds archiving, which sets a team read-only, and warns that archived teams still fall under the expiration policy and may be deleted unless excluded or renewed (Microsoft Learn, Plan for governance in Teams, accessed 2026-10-20). EPC Group's Teams governance practice sets the lifetime, writes the ownerless-group notification address, and defines the archive-before-delete rule for teams that hold records.

Section four: external sharing, per site and per label

External sharing is governed in layers. Microsoft states that SharePoint has sharing settings at the organization level and the site level, that sharing must be allowed at the organization level before any site can share, and that when the two do not match the most restrictive value applies (Microsoft Learn, Overview of external sharing in SharePoint and OneDrive in Microsoft 365, accessed 2026-10-20). A site can be the same as or more restrictive than the organization, never more permissive, and OneDrive can be more restrictive than SharePoint but not more permissive (Microsoft Learn, Manage sharing settings for SharePoint and OneDrive in Microsoft 365, accessed 2026-10-20). The four organization-level choices are Anyone, New and existing guests, Existing guests, and Only people in your organization (Microsoft Learn, Plan sharing and collaboration options in SharePoint and OneDrive, accessed 2026-10-20). The second layer is the label. A sensitivity label scoped to groups and sites can set privacy, external user access, external sharing from labeled SharePoint sites, access from unmanaged devices, authentication contexts and the default sharing link type, and Microsoft cautions that publishing those label settings lets site owners change sharing options by changing the label (Microsoft Learn, Use sensitivity labels to protect collaborative workspaces (groups and sites), accessed 2026-10-20). EPC Group's plan defines three or four container labels, maps each to a sharing level, and makes the label a required field on the provisioning form, so sharing policy is chosen once, at creation, by the person who knows the content.

Section five: retention

Retention answers how long content is kept and when it is deleted. Microsoft distinguishes two instruments: a retention policy assigns the same retain or delete settings to a whole location, such as a SharePoint site, a mailbox, a Microsoft 365 group or a Teams channel, while a retention label assigns settings at the item level, travels with content moved within the tenant, can start its period from an event, supports disposition review, and can mark content as a record (Microsoft Learn, Learn about retention policies and retention labels, accessed 2026-10-20). Microsoft recommends these over the older Exchange messaging records management and SharePoint information management features (same source). EPC Group's data governance practice writes this section as a short schedule: a baseline policy per workload, a label per record class, a default label per library where the information architecture allows it, and a named disposition reviewer.

Section six: ownership and review

A plan with no owner decays. Microsoft's Teams governance guidance asks organizations to document their requirements for expiration, retention and archiving, implement them as part of the rollout, and communicate and publish the policies so users know what behavior to expect (Microsoft Learn, Plan for governance in Teams, accessed 2026-10-20). For cadence, Microsoft's data access governance guidance recommends running site permission and sensitivity label snapshot reports quarterly and sharing-link activity reports monthly (Microsoft Learn, Get the sensitivity label snapshot report for SharePoint and OneDrive sites, accessed 2026-10-20). EPC Group names one accountable owner, convenes a small standing group of workload administrators plus records and security, and attaches the monthly and quarterly reviews to that group's calendar before the plan is signed.

Documented work

ANON-CASES: EPC Group engagement data for Microsoft 365 governance planning covers mid-size and large financial-services organizations bringing Teams and SharePoint growth under a written plan, delivered by the firm's Microsoft 365 consulting practice. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.

Frequently Asked Questions

Talk to a senior architect

If your organization has a governance document that no setting enforces, a 30-minute discovery call with a senior EPC Group architect will map each section to the control behind it. See the Microsoft 365 consulting service hub for engagement structures.

Email contact@epcgroup.net or call 888-381-9725.

a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.