How to implement M365 governance best practices for your self-serve environment

There are lots of benefits to enabling self-service, but managing Microsoft 365 security and sprawl can take time and effort. Understand the Microsoft self-serve environment and check out 5 best practices to set you up for enduring governance success.

People do their greatest work when they have the freedom to collaborate and create, using the technology available to them in the ways that serve them best. For IT admins, though, implementing self-service in Microsoft 365 can feel uncomfortable or even downright dangerous. After all, they’re responsible for the security of their systems and are all too familiar with the risks inherent in a cloud computing environment.

But it doesn’t need to be that way. As an IT leader, you have the power and ability to achieve all the benefits of self-service while keeping it safe and secure. The key to it is smart IT governance.

This blog is the second in our series on self-service, so if you’re interested in an overview of the benefits and risks of enabling self-service, a more in-depth look into the three different methods you can use to manage and secure your environment, or how an automated solution like ShareGate can simplify self-service management for you, check out the other blogs in the series:

• Collaborative governance: The pros and cons of enabling self-service in Microsoft 365 
• 3 methods to avoid sprawl and security risks in your Microsoft self-service environment 
• How ShareGate can help you manage your Microsoft 365 self-serve environment

Understanding the Microsoft self-serve environment

A Microsoft 365 self-service environment is a cloud-based setup where users can access and manage their resources without help from IT. Self-service enables users to perform tasks like password resets, account creation, device registration, team creation, and site-building. In other words: power to the people.

Pros of Microsoft 365 self-service

One of the main advantages of a Microsoft 365 self-service environment is that it boosts user productivity by allowing them to perform everyday tasks without depending on IT. On the same lines, IT can focus on projects more aligned with business goals instead of fighting fires.

Another major benefit of a Microsoft 365 self-service environment is that it permits IT teams to delegate specific administrative tasks to non-IT staff, including department managers. Again, this enables IT to concentrate on more strategic initiatives and reduce their workload.

Also, adhering to Microsoft 365 security best practices allows you to leverage the productivity features of a self-service environment, too.

Cons of Microsoft 365 self-service

You can’t have your cake and eat it too, though. One of the primary concerns on Microsoft 365 self-service environments is that non-IT staff may lack the technical know-how to perform specific tasks, which could lead to errors, security breaches, and the much-dreaded shadow IT.

Another worry is that a self-service environment may be wrong for organizations with complex IT needs or strict security policies. In these cases, access to specific resources may need to be restricted, or additional security measures must be implemented to minimize risks.

Unsurprisingly, security is a major concern in any IT environment, including self-service environments. After all, unauthorized access to sensitive data or resources is one of the most significant security risks in a self-service environment. Access controls such as multi-factor authentication and role-based access control can help mitigate this risk.

5 governance best practices for your Microsoft 365 self-service environment

1. Establish policies that protect and enable effective collaborative governance

There are different ways to define collaborative governance. Still, in the IT context, it’s a governance model that, unlike a traditional top-down control of IT systems, focuses on including end users and other stakeholders within the organization in the development of policies needed for good governance.

Effective collaborative governance is consensus-oriented to reduce conflict and facilitate learning. It’s also the only way to create a Microsoft 365 governance plan that makes self-service possible.  

Setting up your policies and guardrails

Working with key stakeholders in your organization to understand their different needs will help you develop clear guardrails to ensure they can work with the technologies you provide in ways that ensure their productivity but also protect your Microsoft 365 environment and the data on your network. 

Here are a couple of common approaches you should consider when setting up your Microsoft 365 guardrails: 

• Managing passwords and configuring access based on the principle of least privilege, which is the practice of restricting access to only those users, applications, and resources necessary to perform legitimate work functions. 
• Implementing a Zero Trust security strategy requires rigorous and frequent evaluation of users and devices before allowing them to access data or other resources in your network. 

There are many guardrails that you may need to consider including in your IT governance plan for Microsoft 365. Examples include: 

• Using pre-set security policies that use recommended settings to protect against spam, malware, and phishing. Note that in addition to pre-set security policies, Microsoft 365 also allows you to create custom security policies depending on your needs and risks. 
• Reviewing the default share settings for SharePoint, Teams, and OneDrive. They may not be appropriate for your organization’s security needs. If this is the case, modify them based on the least privilege principle.

2. Create a shared understanding for end users with regular training and support

As an IT leader, you can enforce your governance standards by turning features on and off in Microsoft 365 without any explanation to affected end users. But we think this approach is short-sighted.  

In a Microsoft 365 self-service environment, IT governance is a team sport. For example, email is still a common way attackers try to access networks. This is because everyone in the organization uses email, and hackers are getting more sophisticated every day in their attempts to fool users into giving them sensitive information or clicking on malicious links.

The combination of pre-set security policies that IT sets, combined with ongoing training with refreshers on email best practices, remains the best way to thwart these types of attacks.   

To the extent that you engage your users to help them understand the importance of security and what they can do to help protect the network from cybersecurity threats, you will have a more secure system. 

Remember: no one wants to be that employee who accidentally gave a hacker access to your system. ​​​​​​​Providing training is the best way to give your users more peace of mind, and Microsoft’s cybersecurity resources are a great place to start.

3. Monitor and audit self-service activity

Monitoring and auditing self-service activity is essential to ensuring compliance with your IT governance plan. Doing so not only provides a more secure environment but also has other benefits. 

The ability to better protect sensitive information is one of the top benefits and reasons to keep a close eye on end-user activity. Many employees’ jobs involve using, sharing, and storing sensitive information, making monitoring their activities critical to ensuring they don’t inadvertently cause a data breach or loss. In addition, monitoring gives you visibility into how they handle this information and can alert you when using unprotected networks and unauthorized cloud storage sites or devices.  

Monitoring also allows you to help your end users improve their workflows and productivity. By understanding how end users engage with their Microsoft 365 applications, you can identify areas where additional training might help them make better use of different features to be more productive.  

Take advantage of the visibility Microsoft 365 reports provide

In the admin center of Microsoft 365, you’ll find many different reports that offer visibility into your environment and how users engage with it. Here are some examples:

• Looking at login reports can reveal excessive failed login attempts, which can indicate a potential security threat that may need to be investigated.
• Reviewing data access reports will show you who is accessing what data and whether they are internal or external to your organization. This is important to ensure your policies for data access and sharing are being followed. 
• Monitoring reports on Microsoft Teams and Microsoft 365 group creation can help you avoid data sprawl.

You can also use a third-party solution like ShareGate, the out-of-the-box management solution for Microsoft 365, to give you even more visibility, plus the ability to develop custom reports to meet your organization’s unique needs.

4. Implement robust security controls

Self-service is critical to getting the most value from your Microsoft 365 deployment. Implementing robust security controls will help you find the balance between keeping your Microsoft tenant secure and realizing the full benefits of a self-service approach.

On the end user side, self-service means they can use the applications you provide in whatever ways they need to be more productive. On the IT side, your life becomes much easier because you can be confident that the controls required to keep your Microsoft 365 environment safe are already in place.

Here are some examples of robust security controls that all organizations should consider implementing:

• Use multi-factor authentication (MFA) to build up an extra layer of security. MFA requires double authentication: once with a password and then with something like a smartphone or even your fingerprint. With MFA, even if a password is compromised, it’s unlikely that an attacker will be able to access your Microsoft 365 network. 
• Protect all the devices employees use, including their personal devices and the ones provided by the organization. Every device connected to your network represents a potential security threat, so it’s critical to ensure they are properly configured for security. On this note, you may also require users to install Microsoft 365 apps on their personal devices to access the network. This will allow them to work more productively and securely across their devices by sending links to files instead of attachments. 
• Above all, protect your administrator accounts. These are the keys to the kingdom. Microsoft 365 administrators have elevated privileges, making these accounts more attractive and susceptible to cyberattacks. Microsoft 365 has eight different admin roles. It’s essential to ensure your system has the right number of admins with their accounts adequately configured for their other roles based on the principle of least privilege. 

How to ensure security and governance are maintained

Microsoft 365 automation tools are your best friend for keeping your Microsoft 365 environment secure. Microsoft provides some tools to help IT administrators monitor and manage compliance within their organizations. Here are a couple of solutions that you might want to explore to automate much of the oversight needed to ensure the security of your Microsoft 365 implementation:  

• Microsoft 365 Defender is an endpoint security solution that allows you to view and respond to detected security threats, view and edit security policies, monitor and manage devices.   
• Another is Microsoft Purview, which includes various solutions focused on data protection.  
• ShareGate provides automated solutions for monitoring and managing your Microsoft 365 policies to ensure that your end users can collaborate how they need to while following the guardrails you’ve put in place.

5. Run regular access reviews in Microsoft 365

When you enable self-service in your Microsoft 365 environment, end users can create and join groups and invite people from external organizations to join and share files with them directly. While this is a core collaboration feature, it also requires regular access reviews to ensure that the right people can access the right content. 

These collaboration features are made possible through Azure Active Directory (AAD). Given this, conducting access reviews for Microsoft 365 requires an Azure premium license.

Note that the access review in AAD just shows you who has access to what. When you conduct your review, you still need to know who should and shouldn’t have access. This means you’ll need to develop some process for keeping up with group owners to get this information.

With ShareGate, you can also review guest access and external sharing. ShareGate will even ask team owners whether those guests and links are still needed since they’re the ones who know best for their teams. This ensures you’ll see when a guest’s access or external sharing link should be revoked to keep your system secure. And it doesn’t require an Azure premium license. Bonus!

Everything you need for a better IT governance framework

Adopting a self-service mindset and approach to your Microsoft 365 implementation will ensure your organization gets the greatest return on its investment in this powerful productivity suite. However, self-service in Microsoft 365 also requires a plan for IT governance to ensure your system stays safe and secure.   

With the tips in this article, you’ll be well prepared to develop and implement smarter, more effective IT governance for Microsoft 365 that balances users’ needs with the need for IT security.

However, it isn’t easy while implementing IT governance for your Microsoft 365 environment is possible by manually configuring all of your security settings or by building automations in PowerShell or Power Automate. Both methods require a significant investment of time and involve a steep learning curve.

ShareGate makes IT governance for Microsoft 365 easy with intuitive, easy-to-use tools purpose-built for a self-service implementation of Microsoft 365.

Microsoft data governance FAQs