Taming Microsoft 365 Sprawl: Governance That Doesn't Require a Governance Committee

Every Microsoft 365 tenant older than three years has the same archaeology: 4,000 Teams, half named "Test", ownerless SharePoint sites holding financial data, and a Copilot rollout about to index all of it. Governance is no longer optional — but it also doesn't need a steering committee. It needs defaults, labels, and automation.

Fix creation, not creators

Blocking self-service Team creation just moves collaboration to email and shadow IT. Instead, govern the defaults:

• Naming policy — prefix by department, block a profanity/reserved list.
• Expiration policy — 12 months, auto-renewed by activity, so dead teams bury themselves.
• Two-owner minimum — enforced by a weekly remediation script, not a memo.

Connect-MgGraph -Scopes "Group.ReadWrite.All"
$orphans = Get-MgGroup -Filter "groupTypes/any(g:g eq 'Unified')" -All |
  Where-Object { (Get-MgGroupOwner -GroupId $_.Id).Count -lt 2 }

foreach ($g in $orphans) {
  # Escalate to the group's most active member, then to the manager of the last owner
  Send-OwnershipNudge -Group $g
}

Sensitivity labels: the four you need

More than five labels and users stop reading them. Start with Public, Internal, Confidential, Highly Confidential — each carrying real controls (encryption, guest access, sharing scope), not just watermarks.

Lifecycle beats cleanup

One-off cleanup projects decay in a quarter. Durable hygiene is policy-driven:

The scorecard

Track five numbers monthly and publish them to leadership: ownerless group count, guest accounts past review, unlabelled sensitive sites, expired-but-active teams, and sharing links created per week. When those trend flat or down while collaboration volume grows, governance is working — no committee required.