Skip to main content

SharePoint Online administration is the recurring work of running the SharePoint admin center: provisioning and retiring sites, managing site admins and storage, setting and reviewing sharing at organization and site level, and reading the reports that show oversharing and usage. A managed service should cover a weekly operations queue, a monthly governance review built on the data access governance and usage reports, and documented changes to tenant settings. A co-managed agreement should name the tasks, the admin roles held (SharePoint Administrator rather than Global Administrator), hours of coverage, response targets and monthly deliverables. EPC Group, a Houston-based Microsoft consulting firm, provides this as a co-managed service.

Key Facts

  • The Users can create SharePoint sites setting does not stop users from creating Microsoft 365 groups or teams, each of which comes with a site (Microsoft Learn, Manage site creation in SharePoint, accessed 2026-10-20).
  • SharePoint storage is pooled by default; Manual mode allows per-site limits of up to 25600 GB with email notifications (Microsoft Learn, Manage site storage limits in SharePoint in Microsoft 365, accessed 2026-10-20).
  • If external sharing is restricted or turned off, guests typically lose access within one hour (Microsoft Learn, Manage sharing settings for SharePoint and OneDrive in Microsoft 365, accessed 2026-10-20).
  • Data access governance activity reports cover sharing links and Everyone except external users activity in the last 28 days (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20).
  • Usage reports typically become available within 24 to 72 hours and cover 7, 30, 90 and 180 days (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20).

Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group

What SharePoint Online administration covers

SharePoint Online administration is the work of running the SharePoint admin center week after week. Its center is the Active sites page, which lists the communication sites, channel sites and group-connected sites in the organization and is where admins sort, filter and create sites, register hub sites, change sharing for a site, manage storage limits, and add or remove site admins and group owners (Microsoft Learn, Manage sites in the SharePoint admin center, accessed 2026-10-20). Around it sit a handful of tenant settings, site creation, sharing and storage, that decide most outcomes, and a set of reports that show whether those settings are holding. A managed service is useful when it turns that into a fixed rhythm: a weekly operations queue, a monthly governance review, and a record of every settings change. EPC Group's SharePoint consulting and managed Microsoft services teams run it as a co-managed service, with the client's IT team keeping ownership of policy decisions.

Weekly and monthly administration tasks

The weekly queue is operational. EPC Group's standard list:

The monthly review is governance. It runs the data access governance reports, reviews inactive and ownerless sites, compares tenant sharing settings with the approved baseline, checks the storage trend and version storage, and reports the findings with owners and dates. Microsoft's storage planning guidance lists the same levers: automatic or manual site storage limits, automatic version history limits, trimming low-value versions, archiving inactive content to Microsoft 365 Archive, and inactive site policies through SharePoint Advanced Management (Microsoft Learn, SharePoint storage planning, accessed 2026-10-20).

Site provisioning requests

Provisioning starts with one tenant decision. Under Settings > Site creation, the Users can create SharePoint sites option controls whether users can create sites from SharePoint, OneDrive, the PnP PowerShell cmdlet and the REST API, and the same page sets whether new team sites are created under /sites or /teams, plus the default time zone and storage limit for new sites. Microsoft notes that the setting does not affect whether users can create teams or Microsoft 365 groups, and each group always comes with a team site (Microsoft Learn, Manage site creation in SharePoint, accessed 2026-10-20). Microsoft recommends keeping user site creation on and using expiration policies to manage unused sites, and suggests writing custom guidance for site owners on how sites are set up and managed (Microsoft Learn, Plan sharing and collaboration options in SharePoint and OneDrive, accessed 2026-10-20). EPC Group follows that model for most clients: self-service creation stays on, a site template applies the standard structure, and the weekly queue handles the sites that need non-standard sharing or storage.

Storage, sharing and permissions reviews

Storage is pooled by default, so sites draw from a central pool and use what they need. Switching to Manual lets admins set an individual limit per site, up to 25600 GB, with an email notification at a chosen percentage of the limit (Microsoft Learn, Manage site storage limits in SharePoint in Microsoft 365, accessed 2026-10-20). Sharing has four organization-level options, Anyone, New and existing guests, Existing guests and Only people in your organization, plus settings for Anyone link expiration and view-only permission, guest access that expires after a set number of days, reauthentication for verification-code users, and the default link type. Microsoft notes that if external sharing is restricted or turned off, guests typically lose access within one hour (Microsoft Learn, Manage sharing settings for SharePoint and OneDrive in Microsoft 365, accessed 2026-10-20). Each site has its own external sharing option, can limit sharing by domain, and can override the organization-level guest expiration and default sharing link settings (Microsoft Learn, Change the sharing settings for a site, accessed 2026-10-20).

Permissions review uses the data access governance reports. The site permissions report gives a snapshot of the permission structure across all SharePoint and OneDrive sites and identifies sites with the broadest access, such as sites with thousands of users, external guests or Everyone except external users permissions (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20). SharePoint Advanced Management can then delegate a site access review to the owners of overshared sites (Microsoft Learn, SharePoint Advanced Management features in Microsoft Copilot licenses, accessed 2026-10-20), which keeps the remediation decision with the people who know the content.

Reports the admin centers provide

The SharePoint admin center's Reports > Data access governance page holds snapshot reports, for site permissions across the organization and sensitivity labels applied to files, and activity reports, for sharing links and content shared with Everyone except external users over the last 28 days. Microsoft notes that tenants with Microsoft 365 E5 but without SharePoint Advanced Management can use the activity reports only, without snapshot reports or remedial actions, and with results limited to 10,000 sites (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20). SharePoint Advanced Management also provides change history reports for site and organization settings and a recent admin actions panel (Microsoft Learn, SharePoint Advanced Management features in Microsoft Copilot licenses, accessed 2026-10-20). In the Microsoft 365 admin center, the SharePoint site usage, activity and storage reports cover the last 7, 30, 90 and 180 days, typically appear within 24 to 72 hours, and conceal user, group and site names by default until an administrator changes the setting (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20). The site usage report shows files stored, files actively used and storage consumed per site (Microsoft Learn, SharePoint Site usage report, accessed 2026-10-20).

What a co-managed agreement should specify

A co-managed agreement works when both teams know exactly where the line sits. EPC Group's co-managed agreements specify six things: the admin centers and tasks in scope, and those that stay with the client; the admin roles the provider holds, following Microsoft's advice to use roles with the fewest permissions and to limit Global Administrator to emergency scenarios (Microsoft Learn, Manage site storage limits in SharePoint in Microsoft 365, accessed 2026-10-20); the hours of coverage and the escalation path outside them; response and resolution targets for each severity level; the change approval process for tenant settings such as sharing and site creation; and the monthly report pack, named report by report. The agreement should also say who reads the change history reports, so that a settings change made by either party is reviewed by the other.

Documented work

ANON-CASES: EPC Group engagement data for SharePoint Online administration covers mid-size and large organizations in professional services, healthcare, energy and the public sector, with scope spanning co-managed site provisioning, sharing baseline reviews, storage and version management, and monthly governance reporting, delivered by the firm's SharePoint consulting and managed Microsoft services practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.

Primary sources

Frequently Asked Questions

What are the weekly and monthly administration tasks?

Weekly, EPC Group works the site request queue, checks the storage figure on the Active sites page, adjusts site admins and owners, and reviews sharing settings changed on individual sites (Microsoft Learn, Manage sites in the SharePoint admin center, accessed 2026-10-20). Monthly, it runs the data access governance reports, which cover sharing links and Everyone except external users activity over the last 28 days plus permission and sensitivity label snapshots (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20), and reviews the SharePoint usage reports in the Microsoft 365 admin center (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20).

How are site provisioning requests handled?

The first decision is a tenant setting: under Settings > Site creation, Users can create SharePoint sites controls creation from SharePoint, OneDrive, PnP PowerShell and the REST API, and the same page sets the default time zone and storage limit for new sites. Turning it off does not stop users from creating Microsoft 365 groups or teams, each of which creates a site (Microsoft Learn, Manage site creation in SharePoint, accessed 2026-10-20). Microsoft recommends keeping self-service creation and using expiration policies to manage unused sites (Microsoft Learn, Plan sharing and collaboration options in SharePoint and OneDrive, accessed 2026-10-20). EPC Group then applies a site template and naming checks.

How are storage, sharing and permissions reviewed?

Storage is pooled by default; switching to Manual lets admins set per-site limits and turn on notifications at a chosen percentage (Microsoft Learn, Manage site storage limits in SharePoint in Microsoft 365, accessed 2026-10-20). Sharing is reviewed against the organization setting, from Anyone to Only people in your organization, including whether Anyone links expire and are view-only and whether guest access expires automatically (Microsoft Learn, Manage sharing settings for SharePoint and OneDrive in Microsoft 365, accessed 2026-10-20). Permissions are reviewed with the site permissions snapshot report, which finds sites with the broadest access (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20).

What reports does the admin center provide?

The SharePoint admin center offers data access governance reports under Reports: snapshot reports for site permissions, site permissions for a user and sensitivity labels on files, and activity reports for sharing links and Everyone except external users over the last 28 days. Tenants with Microsoft 365 E5 but without SharePoint Advanced Management get activity reports only, limited to 10,000 sites (Microsoft Learn, Data access governance reports for SharePoint and OneDrive sites, accessed 2026-10-20). The Microsoft 365 admin center adds SharePoint site usage, activity and storage reports for 7, 30, 90 and 180 days, with user and site names concealed by default (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20).

What should a co-managed agreement specify (scope, hours, response)?

It should name the admin centers and tasks in scope, the admin roles the provider holds, the hours of coverage, response and resolution targets by severity, the change approval path, and the reports delivered each month. Roles matter most: Microsoft recommends roles with the fewest permissions and limiting Global Administrator to emergency scenarios (Microsoft Learn, Manage site storage limits in SharePoint in Microsoft 365, accessed 2026-10-20), so a provider doing SharePoint work should hold SharePoint Administrator, not Global Administrator. The agreement should also state who reviews change history, which SharePoint Advanced Management records for site and organization settings (Microsoft Learn, SharePoint Advanced Management features in Microsoft Copilot licenses, accessed 2026-10-20).

Talk to a senior architect

If your SharePoint tenant runs without a weekly queue or a monthly governance review, a 30-minute discovery call with a senior EPC Group architect covers the current settings baseline, the reports to start with and a draft scope for co-managed administration. See the SharePoint consulting service hub for engagement structures.

Email contact@epcgroup.net or call 888-381-9725.

a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.

Documented engagements

Each record publishes a redacted primary-source document — a client purchase order, executed agreement or payment record — with a SHA-256 hash you can recompute, and states what the document does not establish.

All documented client engagements

Related reading

AI assistant — not a human