Site templates + site designs + site scripts + PnP Provisioning Engine + Graph API at enterprise scale · Communication vs Team vs Hub site information architecture · Copilot-ready IA + Restricted Content Discovery + sensitivity labels · Enterprise provisioning framework 200-2000+ sites.
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
Enterprise SharePoint site templating in 2026 rests on three Microsoft primitives (site templates + site designs + site scripts) + PnP Provisioning Engine + Graph API for scale. Communication vs Team vs Hub site IA determines Microsoft 365 Groups + Teams downstream effects. Copilot for M365 makes site permissions + content types + sensitivity labels + Restricted Content Discovery load-bearing decisions. 3-7 named site templates per enterprise + governance framework at provisioning is the pattern. EPC Group 4-workstream engagement scoped after discovery.
SharePoint site templating in 2026 is the enterprise discipline of provisioning consistent, governance-compliant SharePoint sites at scale from reusable templates rather than one-off manual builds. Three distinct-but-related Microsoft primitives underpin the discipline: (1) Site templates — Microsoft-provided first-party templates in the template gallery (Communication site templates, Team site templates, plus 40+ pre-built industry templates like Crisis management, Employee onboarding, Team collaboration, New employee onboarding, Learning central, Small business, Retail management) that admins + site owners apply at site creation. Since the 2021 renaming, "site templates" refers to these gallery-registered SharePoint Look Book / template-gallery items — NOT the legacy on-premises "save site as template (.stp/.wsp)" concept, which is deprecated in SharePoint Online. (2) Site designs — a JSON-defined recipe that packages a set of site actions (create lists, apply themes, register add-ins, trigger PowerAutomate flows, add navigation, install SPFx solutions) applied when a template is applied or a site is provisioned. Site designs are registered in the tenant via PowerShell (Add-SPOSiteDesign) or Graph API (POST /admin/sharepoint/tenant/siteDesigns). Multiple designs can be attached to the same site template. (3) Site scripts — the low-level JSON action set that a site design executes. Site scripts define individual actions (createSPList, applyTheme, joinHubSite, etc.). A site design references one or more site scripts. Enterprise pattern: site templates + site designs + site scripts + PnP Provisioning Engine + Graph API deployed together as a governed provisioning system.
Six decision criteria for choosing your site-provisioning approach in 2026: (1) Simplicity — first-party site templates are the simplest; site owner picks from the gallery at creation. (2) Depth of customization — site designs + scripts handle moderate customization (theme + lists + navigation + PowerAutomate + SPFx) but cannot orchestrate complex content deployment. PnP Provisioning Engine handles deeper deployments (content types + lookup lists + composed looks + files + list items + permissions + custom actions + workflows). Graph API handles the deepest programmatic control (any Graph-exposed resource + full REST integration with your provisioning workflow). (3) Governance surface — site designs + site templates are governed centrally in the tenant admin center; PnP + Graph API deployments need their own governance framework. (4) Reusability — site designs can be re-applied to existing sites (not just at creation); PnP + Graph API can too but with more custom code. (5) Speed to build vs speed to run — site designs + templates are faster to build for standard patterns; PnP + Graph API are faster to run for large-scale bulk provisioning (200+ sites). (6) Team skill set — site designs + scripts need JSON authoring skills; PnP Provisioning Engine needs PowerShell + PnP CLI skills; Graph API needs REST integration + auth + SDK skills. Enterprise pattern: use first-party site templates for the "standard site" (Communication + Team + specific gallery templates), site designs + scripts for governance overlay (theme + navigation + list creation + hub join), and PnP Provisioning Engine + Graph API for bulk provisioning + content deployment + programmatic-workflow integration. Multi-tool approach is normal — not a "choose one" decision.
Enterprise SharePoint IA in 2026 rests on three site-type primitives + hub-site orchestration: (1) Communication sites — designed for broadcast + intranet + news + landing pages + department portals; use for company intranet + HR portal + IT portal + business-unit landing pages; typically NO Microsoft 365 Group backing (Communication sites are group-less by default). (2) Team sites — designed for collaboration + document management + team spaces + project sites; use for department + project + team collaboration; typically Microsoft 365 Group backed (includes Outlook mailbox + Planner + Teams channel + OneNote + SharePoint site). (3) Hub sites — a Communication or Team site elevated to "hub" status that aggregates other sites; child sites join the hub for shared navigation + shared theme + rolled-up news + rolled-up activities. Enterprise pattern: 3-7 hub sites per business unit organized around business function (Corporate + HR + IT + Finance + Product Line 1 + Product Line 2 + etc.); each hub has 30-200 associated sites. Governance decisions: (1) Communication sites are appropriate for content that is READ by many but AUTHORED by few (intranet + policy library + product catalog). (2) Team sites are appropriate for content that is COLLABORATED on by a defined team (project + department + working group). (3) Do NOT use Team sites for intranet content — the group-mailbox + Teams-channel overhead is unnecessary and drives sprawl. (4) Do NOT use Communication sites for team collaboration — the read-oriented UX + lack of group backing limits collaborative workflows. (5) Hub site associations are relatively easy to change; site-type conversion (Communication ↔ Team) is difficult + often requires migration.
Copilot for M365 (GA March 2024, expanding through 2026) fundamentally changes SharePoint IA decisions because Copilot grounding depends on well-structured, appropriately-permissioned SharePoint content. Seven Copilot-driven implications for site templating: (1) Content type architecture matters more — Copilot uses content types + metadata + terms in the term store for entity understanding + citation quality. Site templates should provision the enterprise-standard content types + not leave content-type design to end users. (2) Site permissions matter more — Copilot respects SharePoint permissions in its grounding; oversharing sites (Everyone-Except-External-Users + broken permission inheritance + orphaned groups) directly cause Copilot oversharing incidents. Site templates should provision correct default permissions + require permission review before broad sharing. (3) Site sensitivity labels — sensitivity labels applied at site level determine what Copilot can + cannot ground on; site templates should apply the correct sensitivity label per site type (Internal + Confidential + Restricted). (4) Information architecture supports Copilot search — well-organized sites with clear content types + navigation + hub structure produce better Copilot answers; scattered + siloed + inconsistent sites degrade Copilot answer quality. (5) Restricted Content Discovery (RCD) — a per-site setting (GA Q1 2026) that prevents Copilot from indexing content while leaving normal user access untouched; useful for legal + M&A + HR + finance sites that should not surface in Copilot answers. Site templates should provision the correct RCD default per site type. (6) Search-scope + query scoping — site templates should provision consistent search scopes + refiners + result sources for Copilot Semantic Index alignment. (7) Purview integration — DLP + information barriers + audit logging should be provisioned by site templates + governance framework at site creation, not retrofitted after the fact. Enterprise pattern: treat every new site provisioning as a Copilot-grounding decision + treat site templates as the enforcement point.
Seven patterns for enterprise-scale SharePoint site provisioning + governance: (1) Provisioning request portal — build a PowerApps + SharePoint-list + Power Automate approval workflow where site owners request sites; approval enforces sensitivity + permission + naming + hub-association + retention decisions before provisioning; feeds into the provisioning engine (PnP or Graph API). (2) Naming conventions — enforce named naming conventions (prefix + site name + business unit + purpose) at provisioning; enforce via provisioning-portal validation + Azure AD naming policy for group-backed sites. (3) Site classification labels — apply site sensitivity labels + retention labels at site creation via site design / PnP template; labels drive downstream governance (retention + DLP + audit + Copilot RCD). (4) Hub-site associations — auto-associate provisioned sites to the correct hub based on business unit + purpose selected in the provisioning request; ensures nav + theme + news roll-up consistency. (5) Bulk provisioning via PnP Provisioning Engine or Graph API — 200+ sites at once (mergers + acquisitions + reorganizations + new-business-unit stand-up) require scripted provisioning + parallel + resumable + auditable execution. (6) Governance sustainment — site-inactivity policies + orphaned-site cleanup + owner-attestation + Group Expiration policies + AAD access reviews + auto-generated management + Purview audit-log analysis; sites are provisioned continuously so cleanup must be continuous. (7) SharePoint admin center + PowerShell reporting — regular reports on site count + storage + owner attestation + last-activity + sensitivity + hub association + template + design + external sharing surface; feeds into quarterly governance review. Enterprise pattern: named provisioning framework + 0.25-0.5 FTE per 1000 sites for governance + quarterly governance reviews + Purview integration.
Seven common mistakes + how to avoid: (1) Legacy "save site as template" (.stp / .wsp) muscle memory — the classic on-prem approach is deprecated in SharePoint Online; do NOT try to migrate legacy templates directly. Use site templates + site designs + site scripts + PnP Provisioning Engine instead. (2) Applying site designs after major content changes — site designs are idempotent by design but complex content-heavy sites can break subtle content-type + list-view + custom-action interactions; test on a non-production site before applying to production. (3) Not versioning provisioning artifacts — site designs + PnP templates + Graph API scripts are configuration-as-code; version them in Git + review changes + track deployments; not managing this results in "which version of the template did this site come from" chaos. (4) One-size-fits-all site templates — building a "corporate standard" template that fits nobody perfectly + everyone poorly; enterprise pattern is 3-7 named site templates (Communication landing + Team collaboration + Project + Sales-account + HR-employee + IT-service + Executive-briefing) with variants per business unit. (5) Ignoring Microsoft 365 Groups downstream effects — group-backed Team sites create Teams + Planner + Outlook mailbox + OneNote; provisioning 200 sites means provisioning 200 groups + 200 mailboxes + 200 Teams; if governance + expiration + naming are not planned, sprawl follows. (6) Skipping permission-inheritance design — sites inherit permissions from the parent site collection + hub; misconfigured inheritance causes oversharing (bad for Copilot + audit) + undersharing (blocks legitimate access). Site templates should provision the correct default permission model + document the exceptions. (7) Not integrating with Copilot governance from Day 1 — retrofitting Restricted Content Discovery + sensitivity labels + search-scope configuration onto already-provisioned sites is 10-50× the work of provisioning correctly at Day 1. Enterprise pattern: run a SharePoint IA + governance workshop BEFORE the first template is built.
Fixed-fee scope covering four workstreams: (1) Discovery + Information Architecture (2-4 weeks) — existing site inventory + site-type + permission + content-type + hub baseline, business-unit + persona + workflow mapping, site-template gap analysis + template-catalog design (typically 3-7 site templates + variants), Copilot readiness + governance-framework baseline, licensing model + Microsoft 365 Group + Teams downstream effects assessment. (2) Site Template + Design + Script Build (3-6 weeks) — site scripts + site designs + first-party template selection + PnP Provisioning Engine template packaging + Graph API integration where required, provisioning-portal design + PowerApps + Power Automate approval workflow, sensitivity label + retention + Purview DLP + RCD default configuration per template, naming convention + hub-association + permission-model per template, versioning + Git + configuration-as-code discipline. (3) Enterprise Deployment + Rollout (6-16 weeks) — provisioning-engine deployment + provisioning-portal rollout, bulk migration of existing sites to the new template framework (typically 200-2000+ sites across a program), Microsoft 365 Group + Teams governance integration, Copilot governance overlay (RCD + sensitivity labels + oversharing remediation), Purview + DLP + audit integration, user + admin training + change management. (4) Sustainment + Continuous Improvement (ongoing) — quarterly template + design + script review + refresh, site-inactivity + orphaned-site cleanup + owner-attestation + Group Expiration + AAD access-review integration, Copilot for M365 governance evolution + RCD + sensitivity label + search-scope tuning, Purview audit + DLP + information barriers optimization, ongoing SharePoint + Copilot admin operational review + roadmap alignment. Fixed-fee scopes, quoted after discovery: mid-market SharePoint provisioning framework; large-enterprise multi-tenant multi-business-unit deployment. Anchored by Microsoft Solutions Partner Modern Work + Data & AI + Security + Digital & App Innovation + Business Applications + Infrastructure designations. Named senior consultants with MS-102 + MS-500 + PL-200 + PL-400 + PL-600 + SC-400 credentials + demonstrated enterprise SharePoint + Copilot + Purview engagement leadership. Delivered under fixed-fee scope with named senior architect + Project Tahoe pre-release program participation heritage from EPC Group Founder & Chief AI Architect Errin O'Connor.
30-min qualification with senior SharePoint architect. Information architecture + template-catalog design within 15 business days. Call (888) 381-9725.
Monday-Friday, 8 AM - 7 PM CT
We respond to all inquiries within one business day
AI assistant — not human