RemoteMicrosoft 365 governance
Microsoft 365 doesn't get messy on its own. It gets messy without an owner.
Too many admins, Teams nobody remembers creating, guests from old projects, sites without owners and files shared far too widely. Here is why it happens, the fixes in the order that matters, the routines that keep it tidy, and a 10-point check of your tenant.
Microsoft details from Microsoft Learn, checked 31 October 2026.
- Root causes
- Fixes in order
- 10-point tenant check
Reviewed by Blake Bath, General Manager, on 31 October 2026.
What it looks like
Five signs a tenant needs governance.
Each one makes everyday work slower and riskier.
Can't find anything
Files in dozens of Teams and sites, with no obvious home.
- Structure
- Owners
- Naming
Teams sprawl
Hundreds of Teams, half of them unused.
- Expiry
- Archive
- Request process
Too many admins
Global Admin handed out to solve small problems.
- Specific roles
- Break-glass
- Reviews
Ghost accounts
Leavers and old guests still active.
- Last-day removal
- Guest expiry
- Licences reclaimed
Over-shared files
Links that reach far beyond the intended people.
- Specific people
- Link expiry
- Labels
Microsoft 365 tenant check
How tidy is your tenant?
Tick what is true today. The gaps come back in the order we would fix them.
Tick what is true for your tenant today.
Where you stand
0of 10 controls in place
10 gaps to close.
- Few Global Admins, plus two break-glass accountsEach extra Global Admin is another way to lose the whole tenant.
- Conditional Access in placeWithout it, security depends on each user's settings.
- Leavers disabled on their last dayOld accounts are a common way in and a quiet licence cost.
- Guests reviewed and expiredGuests from finished projects keep their access.
- Every Team and site has two ownersOwnerless spaces can't be tidied or approved.
- Teams creation is controlledUnrestricted creation is how sprawl starts.
- External sharing set deliberatelyBroad links travel further than anyone intends.
- Inactive Teams and groups expire or archiveOld spaces clutter search and hold forgotten data.
- Audit logging on, with alertsYou can't investigate what wasn't recorded.
- Someone owns the tenantWithout an owner, nothing stays tidy.
Why it happens
Why tenants get messy.
- Self-service everythingAnyone can create a Team, site or group from day one.
- No structureSharePoint shaped by whoever clicked New first.
- No offboarding disciplineAccounts, licences and access outlive the person.
- Admin creepGlobal Admin given to fix one problem, never taken back.
- No Conditional AccessSecurity depends on individual settings.
- Sharing never reviewedSettings left as they were when the tenant was created.
In this order
The fixes, in the order that matters.
| Step | What to do | Why first |
|---|---|---|
| 1. Admins | Cut Global Admins, add break-glass, use specific roles | Protects everything else |
| 2. Sign-in | Conditional Access baseline | Stops account takeover |
| 3. People | Disable leavers, remove stale guests, reclaim licences | Closes forgotten doors, saves money |
| 4. Teams and sites | Archive inactive, appoint two owners for the rest | Makes the rest manageable |
| 5. Sharing | Specific people by default, link expiry | Limits what leaks |
| 6. Audit and alerts | Audit on, alerts on risky changes | So you know when it drifts |
| 7. Structure | Hub sites, naming, templates | A longer programme |
Ongoing
The routines that keep it tidy.
- Quarterly admin reviewWho has which role, and why.
- Licence reconciliationLeavers removed, plans matched to roles.
- Group expirationOwners renew Teams and groups or they expire. Needs Entra ID P1.
- Guest and access reviewsAutomated access reviews need Entra ID P2 or ID Governance; a manual review works too.
- Sensitivity labelsOn confidential content, so sharing rules follow the file.
- Alerts acted onForwarding rules, admin changes and risky sign-ins.
What to avoid
Common clean-up mistakes.
- Fixing everything at onceAdmins and sign-in first; structure is a longer programme.
- Deleting without warningArchive, tell people, then delete after a cooling-off period.
- Locking down overnightPhase controls in, with communication, so work doesn't stop.
- No named ownerWithout one, the tenant drifts back.
Our view
Governance is a few habits, not a big project.
Most of the mess we see comes from a few defaults never being decided and nobody owning the tenant. The fix starts with security, because that's where the risk is, then works through people, spaces and sharing.
After the clean-up, a handful of routines keep it tidy: quarterly admin and guest reviews, group expiry, licence reconciliation and alerts someone actually reads.
How we work
A tenant clean-up in five steps.
- Step 1Review
Admins, sign-in, accounts, Teams, sharing.
- Step 2Secure
Admins and Conditional Access first.
- Step 3Clean up
Leavers, guests, licences, inactive spaces.
- Step 4Set the rules
Creation, sharing, expiry, naming.
- Step 5Keep it tidy
Quarterly reviews and alerts.
Related guides
Microsoft 365 done properly. Security, structure, licences.
The pieces of a well-run tenant.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about Microsoft 365 governance.
Why does our Microsoft 365 feel messy?
Usually because anyone could create Teams and sites, nobody owned the tenant, leavers and guests were never cleaned up, and admin rights spread over time. It still works, but every task gets slower and riskier.
Where should we start?
Admins and sign-in first: cut Global Admins down and put Conditional Access in place. Then leavers and guests, then Teams and SharePoint, then sharing and lifecycle. Information architecture is a longer piece of work.
Should we stop staff creating Teams?
Not necessarily. Many businesses use a simple request process, a naming convention and two owners per Team. The aim is that every space has an owner and a purpose.
Can old Teams and groups expire automatically?
Yes. A Microsoft 365 group expiration policy renews groups that are in use and asks owners to renew the rest. Groups that aren't renewed are deleted and can be restored within 30 days. It needs Entra ID P1, which is in Business Premium.
Should we just delete old Teams?
Archive first and tell people, then delete after a cooling-off period. Check retention needs before deleting anything that holds business records.
How long are audit logs kept?
Audit (Standard) keeps 180 days. Longer retention needs Audit (Premium) or sending logs elsewhere.
Next step
Want your tenant cleaned up and kept that way?
We review admins, sign-in, accounts, Teams, SharePoint and sharing, fix them in the right order, and set up the routines that stop the mess coming back.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. Microsoft details from Microsoft Learn. Checked 31 October 2026. Microsoft Learn, Compare groups in Microsoft 365; Microsoft Learn, Microsoft 365 group expiration policy; Microsoft Learn, Manage external sharing in SharePoint; Microsoft Learn, Access reviews overview; Microsoft Learn, Auditing solutions in Microsoft Purview