SharePoint governance: complete reference

Last updated August 4, 2026 · By Sean Regan

1. What "governance" means in SharePoint Online

SharePoint governance is the set of policies, controls, and processes that determine who can do what, with which content, for how long. It spans three planes^[1]:

2. Site lifecycle & provisioning

In a default tenant, any licensed user can create a Microsoft 365 Group — which in turn provisions a SharePoint site, a Teams workspace, a Planner plan, and a mailbox. Without controls, this produces hundreds of unclassified, owner-less sites within a year. Governance levers^[1]:

• Group creation restriction — limit M365 Group creation to a security group via Entra ID PowerShell.
• Naming policy — prefix/suffix and blocked-word lists applied at group creation.
• Expiration policy — auto-renew on activity, otherwise prompt owners to renew or delete (default 180 days).
• Hub sites — associate up to 2,000 sites with a hub for shared navigation, theme, and search scope.
• Site templates / PnP provisioning — codified site definitions deployed through the SPO Site Designs feature or PnP templates.
• Inactive site policies — Microsoft 365 Archive lets you move stale sites to cold storage at a fraction of the storage cost.

3. Sensitivity labels for sites & files

Sensitivity labels are the modern primary classification mechanism. A single label applied to a site can enforce^[2]:

• Privacy (public vs private M365 Group)
• External user membership (block/allow guests)
• External sharing scope (Anyone, NewAndExisting, ExistingGuests, ExistingExternalUsersAndUsersInDirectory, Disabled)
• Unmanaged device access (block download, web-only access)
• Default sharing link type and permission (View vs Edit)

File-level labels can additionally apply encryption (Microsoft Purview Information Protection), content marking (headers, footers, watermarks), and auto-labeling based on trainable classifiers or sensitive-info types like credit-card numbers^[2]. Site labels and file labels are independent: a Confidential site can contain Public files, and vice versa.

4. Data Loss Prevention (DLP)

DLP policies inspect file content and metadata, and trigger actions when a match occurs. In SharePoint Online the locations a single policy can target are^[3]:

Policy tips (the warning users see in Office apps) require both a DLP policy and the corresponding Microsoft 365 license tier. Most actionable DLP requires E5 or the standalone Purview Information Protection & Governance add-on^[3].

5. Retention & records

Retention policies in Microsoft Purview either retain content for a fixed period (preventing deletion), delete it after a period, or both. For SharePoint, retention applies at the site level and propagates to every file^[4]. Retention labels go further:

• Retention label — applied to a file or folder; carries a retention period and action.
• Record — locked file that cannot be edited or deleted while the label applies.
• Regulatory record — locked even from administrators; immutable for the full retention period.
• Event-based retention — retention clock starts on an event (employee leaves, contract ends), not on file creation.

Deleted SharePoint files first go to the site Recycle Bin (93-day default), then the second-stage Recycle Bin (subset of the same 93 days). After that, recovery is only possible via a Microsoft support ticket within a small window. Retention overrides this for any file the policy covers^[4].

6. External sharing controls

Five external-sharing levels exist, configurable at both the tenant and the site level. The site setting cannot exceed the tenant ceiling^[5]:

Additional controls: domain allow/block lists, guest reauthentication interval, link expiration defaults, default link type (Anyone vs Specific people), and unmanaged-device download blocks^[5].

7. Conditional access & device policies

Conditional access (Microsoft Entra ID) is the chokepoint for how users reach SharePoint. Common policies:

• Block legacy authentication — disable Basic auth protocols that bypass MFA.
• Require compliant device — only Intune-managed devices reach SharePoint content.
• Web-only access for unmanaged devices — disables download and sync from non-corporate machines.
• Block downloads for guests — guests can view but not retrieve files.
• Sign-in frequency — force re-authentication every N hours for sensitive sites.

8. Copilot readiness

Microsoft 365 Copilot answers user prompts using every file the user has at least Read access to. That includes inherited access through "Anyone with the link" sharing, M365 Group membership, and Site Members groups. Any pre-existing oversharing becomes a search problem the moment Copilot is enabled^[6].

The pre-deployment checklist:

1. Inventory "Anyone with the link" sharing across the tenant. Replace or revoke.
2. Audit Site Members groups for users who should not have org-wide visibility.
3. Apply sensitivity labels to confidential sites (HR, Finance, Legal, M&A).
4. Enable Restricted Content Discovery (RCD) on high-sensitivity sites so Copilot ignores them at search time.
5. Turn on Copilot usage reports and run a 30-day audit before broad rollout.

See the full step-by-step in SharePoint external sharing report & Copilot readiness.

9. Tooling comparison

Purview is the policy layer; the third-party tools (and Smart Permissions) sit alongside it for visibility, audit, and remediation that Purview alone does not provide at scope.

References

1. [1] Microsoft Learn — SharePoint governance overview
2. [2] Microsoft Learn — Sensitivity labels for Teams, M365 Groups, and SharePoint sites
3. [3] Microsoft Learn — Learn about Data Loss Prevention
4. [4] Microsoft Learn — Retention policies for SharePoint and OneDrive
5. [5] Microsoft Learn — Manage external sharing for your SharePoint environment
6. [6] Microsoft Learn — Microsoft 365 Copilot overview

Related

• SharePoint permissions inheritance: complete reference
• SharePoint Online migration: complete reference
• Free ShareGate Protect alternative, AvePoint Policies & Insights alternative, Syskit Point alternative
• External sharing report for Copilot readiness · How to audit SharePoint permissions