Engagement Tiers
40-60 hrs senior architect time. Ongoing operations + escalations + policy updates + monthly review.
Project-based remediation sprints. Pick 2-3 domains per quarter to advance.
Dedicated team. Monthly reviews + adoption + Copilot enablement + executive QBR.
The 8 Governance Domains
Auto-classification, owner approval, 90-day inactivity archive policy.
Closed by default, request access workflow, no broken inheritance.
Purview retention labels per content type + jurisdiction.
Autolabeling for regulated content, Copilot guardrails, DLP.
Per-site tier (not tenant-wide), exception approval workflow.
Oversharing remediation, Restricted Content Discovery, DLP for Copilot.
Quarterly owner attestation, site review, role changes.
Viva Insights + Page Analytics, executive reporting.
FAQ
What is SharePoint governance consulting (ongoing) vs a one-time health check?
A SharePoint Governance Health Check is a 3-week productized assessment that produces a maturity report + 90-day remediation plan. SharePoint Governance Consulting is the ongoing engagement that DELIVERS the remediation and operates governance as a managed service. Most clients start with the Health Check, then engage EPC Group for 6-24 months of governance consulting to execute the roadmap and operate steady-state.
What does ongoing SharePoint governance cover?
8 domains: (1) Site provisioning + decommission policies, (2) Permission model (closed default, request access workflow), (3) Content lifecycle (Purview retention labels), (4) Sensitivity labels (autolabeling for regulated content), (5) External sharing tier (per-site policy), (6) Copilot readiness (oversharing remediation, sensitivity cascade), (7) Site review cadence (quarterly owner attestation), (8) Adoption metrics + reporting.
How is this engagement structured?
Three tiers: (a) Monthly governance retainer (40-60 hrs senior architect time, ongoing operations), (b) Quarterly engagement (project-based remediation sprints), (c) Annual governance program (dedicated team, includes monthly reviews + adoption coaching + Copilot enablement).
When do we need SharePoint governance consulting?
Indicators: (1) Tenant has 5+ years of SharePoint history without formal governance, (2) Microsoft 365 Copilot rollout planned in next 12 months, (3) Regulatory exam or audit upcoming (HIPAA, SOC 2, FedRAMP), (4) Oversharing or external sharing incident, (5) Migration from on-prem to SharePoint Online recently completed, (6) Multi-tenant or M&A creating governance drift.
Do you provide governance for Microsoft Teams + OneDrive too?
Yes. SharePoint governance in 2026 IS Microsoft 365 governance because Teams sits on SharePoint (Teams files = SharePoint sites) and OneDrive shares the same Purview/Entra/Defender controls. EPC Group governance engagements cover SharePoint sites + Teams + OneDrive + Loop + Lists as a unified workload.
How does governance enable Microsoft 365 Copilot?
Copilot grounds responses on Microsoft Graph content (SharePoint + OneDrive + Teams + Email + Loop). Without governance: Copilot answers using oversharing exposure (employees see salary tables, M&A docs, executive plans they should not). EPC Group governance engagements include the Copilot-required prerequisites: (1) Oversharing remediation, (2) Sensitivity label cascade with autolabeling, (3) Restricted Content Discovery (the control that replaced Restricted SharePoint Search, closed to new enablement on July 31, 2026) for sensitive sites, (4) Purview DLP for Copilot, (5) Copilot prompt audit trail review cadence.
What roles do you fill in an ongoing governance engagement?
EPC Group delivery model: (1) Senior SharePoint Architect (governance design + escalations), (2) Junior consultant (implementation work, policy authoring, audit reports), (3) Quarterly Executive Review with Errin O'Connor or named principal. Client provides: SharePoint admin (1.0 FTE), security stakeholder (0.25 FTE), compliance stakeholder (0.25 FTE).
How do you measure governance success?
Quarterly governance scorecard: (1) % sites with active owner (target 95%+), (2) % sites with sensitivity label coverage (target 80%+ regulated content), (3) Number of orphaned permissions (target 0 net-new per quarter), (4) External sharing exception count, (5) Site review attestation rate, (6) Copilot prompt audit findings (target zero exposed sensitive content), (7) Adoption: Viva Insights + Page Analytics engagement metrics.
Can we do governance ourselves with internal staff?
Some organizations succeed with internal governance staffing. Requires: (a) Senior SharePoint admin with governance experience, (b) Dedicated compliance + security partnership, (c) Executive sponsor with mandate to enforce, (d) Microsoft Purview + Defender + Entra licensing. EPC Group accelerates startup (6-12 months) and provides expertise depth most internal teams lack. Many clients combine internal team + EPC Group fractional architect (lower retainer tier).
Why EPC Group?
SharePoint consulting (since SharePoint 2003 beta team since 1997). Errin O'Connor authored 4 published books including SharePoint inside-out and migration volumes. EPC Group is a Microsoft Solutions Partner with all six designations under the Microsoft AI Cloud Partner Program. Hundreds of governance engagements delivered, including HIPAA + FedRAMP environments. Errin coined "SharePoint is the biggest Swiss Army knife in the world" (Infonomics, Jan/Feb 2009).
Related
Schedule Your Governance Engagement
SharePoint governance since 1997. Hundreds of Fortune 500 engagements.
Related reading
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Samsung Semiconductor, Inc. — SharePoint Server 2019 build and deployment: custom user experience, navigation, web parts, search, enterprise-application integration, quality assurance and training (2021)Samsung Semiconductor, Inc. · 2021 · Contracted — countersigned
- Canadian Forces Morale & Welfare Services (CFMWS) — SharePoint consulting support (2014)Canadian Forces Morale & Welfare Services (CFMWS) · 2014 · Contracted
- Stryker Corporation — SharePoint Center of Excellence development (2012)Stryker Corporation · 2012 · Delivered — payment-corroborated (client payment records published)
- Federal Reserve Bank of New York — SharePoint best-practices needs assessment, architecture and governance gap analysis, roadmap for a global SharePoint Center of Excellence across the twelve Reserve Bank districts (2010)Federal Reserve Bank of New York · 2010 · Contracted — countersigned, with historical work product
- Copilot and SharePoint AI Governance: Regional Bank (2024)Anonymized engagement summary · Regional bank · 2024Engagement phase: governance and readiness planning before a Copilot rollout; no rollout is reported
- SharePoint Intranet Permission Automation: Contractor (2024)Anonymized engagement summary · Federal government contractor · 2024
- Two SharePoint Farms to SharePoint Online: Regional BankAnonymized engagement summary · Regional bank · 2024
- SharePoint Health Check, Upgrade and Support: ManufacturerAnonymized engagement summary · Consumer-products manufacturer · 2017–2023
More engagements: NASA (agency-wide, across the NASA Centers) — Agency SharePoint Phase 1 Initiative: needs assessment, architectural review, governance, and a global SharePoint Center of Excellence for knowledge management, intranet and enterprise content management across the NASA Centers (2009–2010) · National Archives and Records Administration (NARA) — SharePoint records management and Center of Excellence advisory and implementation support (2010) · National Institutes of Health — SharePoint Center of Excellence design (2010) · Northrop Grumman — 'Finance I.R.M. Automation Process' statement of work on SharePoint (2010) · NASA Johnson Space Center — SharePoint Site Provisioning Solution (2009) · YMCA (Houston) — Microsoft Office SharePoint Server 2007 implementation (2007) · SharePoint Support and Custom Apps: Professional Services · SharePoint 2010 to 2019 Migration: Regional Bank (2020) · SharePoint Online Document Management: Transportation (2020) · SharePoint 2010 to Online Design: Global Law Firm (2018) · SharePoint 2016 Intranet Redesign: Energy Company (2018) · SharePoint Intranet Redesign: Financial Services · SharePoint Migration: Major Healthcare Network