The operating principle
The person who creates a site should not be its only owner
Every active business site should have an accountable owner and a second contact for access or retention decisions. Otherwise a departing administrator or project manager can leave content accessible but effectively unmanaged.
Create a site inventory people can actually govern
List active sites, libraries, Microsoft 365 Groups and Teams relationships; identify the business owner and at least one deputy for each. Note guest access, anonymous links where allowed, retention classifications, inactive project areas and sites whose owners have left. The purpose is not a huge compliance spreadsheet: it is to see where ownership and exposure no longer match the business.
Separate site provisioning from policy. Users may have legitimate reasons to make new collaborative spaces, but a naming standard, owner role and lifecycle process help prevent abandoned collections. Review what happens when a project ends or a team merges with another department rather than keeping every site indefinitely.
| Review area | Evidence to retain | Decision owner |
|---|---|---|
| Site ownership | Primary and deputy owner | Business department |
| Sharing baseline | Tenant and site-level policy | Security and collaboration owner |
| Guest access | Guest identities, link type and purpose | Site owner with policy approval |
| Inactive sites | Last activity and retention classification | Records and business owner |
Understand the strictest sharing control
Microsoft's SharePoint settings apply at organisation and site levels: a site can be more restrictive than the tenant, not more permissive. OneDrive cannot be configured more permissively than SharePoint at the organisational level. This matters when someone asks why a guest cannot open a document despite receiving a link.
Check Microsoft Entra external collaboration permissions and the related Microsoft 365 Group or Teams configuration as part of the same diagnosis. Do not weaken an organisation-wide setting to resolve one collaboration issue. Verify the approved use case, identify the effective restriction and make a narrow, documented change where appropriate.
Documented administration controls
- Document tenant sharing baseline and site-level exceptions
- Check Teams/Group guest access dependencies
- Review anonymous and externally shared links where permitted
- Test a real guest account under approved conditions
- Record an owner and review date for each exception
Build an operational change and handover record
Record why a permission changed, who requested and approved it, what was altered and how the result was tested. An audit trail should connect the business reason to the technical action rather than simply show that an administrator clicked Save. Periodically compare current members with employment and project status.
SharePoint administration does not automatically include site-content editing, legal retention decisions, migration tooling or user-training projects. Those may be useful adjacent engagements, but should be scoped and priced separately. Before switching support providers, export a readable inventory of owners, policies, outstanding exceptions and service accounts.
Govern permissions at site level and tenant level together
SharePoint and OneDrive sharing controls have tenant-wide ceilings and site-specific restrictions. A site owner may not be able to grant access if the tenant policy forbids it; conversely, permissive tenant settings do not authorise sharing confidential files with everyone. Record business site owners, team/group relationships, guest-access requirements and the requested sharing duration. Avoid granting broad tenant administration to a supplier for a routine library request.
Site sprawl often leaves content without an accountable owner. Review sites connected to inactive Teams, external access grants, sensitive libraries, guest users and sites owned by departed employees. The correct response is not simply deleting unused-looking content: confirm legal retention, workflow dependencies and actual departmental ownership first.
| Governance decision | Evidence to request | Acceptance |
|---|---|---|
| New project site | Sponsor, owners, lifecycle and sensitivity | Site created with approved ownership |
| External collaborator | Identity, permitted library, term and owner | Guest can access only agreed content |
| Permission escalation | Role, business justification and expiry | Audit event and requester confirmation |
| Dormant site closure | Retention and business dependency review | Disposition approved and recoverability known |
Create a repeatable site-review cadence
Agree when to review guest access, privileged site ownership, dormant content, sharing settings and the effect of new Teams-connected spaces. Use exceptions with named owners and due dates rather than a blanket promise to eliminate all external access. The monthly service record should show which sites were reviewed, what changed and what remains a client decision.
A customer-controlled exit plan includes the site inventory, access review evidence, automation dependencies and transfer of any supplier-managed groups. This helps the next administrator inherit clear information instead of rediscovering undocumented decisions.
Documented administration controls
- Every important site has accountable business owners
- Guest sharing reviewed against information sensitivity
- Tenant and site policy precedence checked
- Dormant site retention reviewed before deletion
- Provider offboarding includes ownership and runbook transfer
The most useful sign of mature SharePoint administration is a clear answer to a simple question: who is responsible for this site, and who can approve access to it today?
Primary technical references
Check current feature and licence requirements before changing a tenant. A service description is not evidence that a customer has purchased or activated an option.
Commercial next step
Map your SharePoint ownership and sharing controls
Share approximate active sites, user counts, Teams integration, guest-sharing concerns and support hours. We can outline a tenant-governance review and ongoing administration boundary.
Request an administration assessment