SAMPLE-SPO-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · SharePoint, Teams and OneDrive Governance Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Sharing, guests, ownership, labels and oversharing for 340 fictional SharePoint sites and 85 teams.
Executive summary
Sharing is open by default and many sites are visible to the whole organisation, including finance and HR. Ownership is thin and guests are not reviewed. Before widening Copilot, the broadly shared sites should be restricted.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Organisation sharing settings screenshot | SharePoint and OneDrive | Provided |
| E-02 | Site permissions report | 340 sites | Provided; metadata only |
| E-03 | Guest list export | 212 guests | Provided |
| E-04 | Sensitivity label settings and file counts | 4 labels | Provided |
| E-05 | Site owner report | 340 sites | Provided |
What was not checked
- Document and message content
- Individual file permissions
- Third-party app access
- Teams private channel membership
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Organisation-level setting allows the most permissive link type | E-01 | Choose a more restrictive default and restrict exceptions at site level. |
| F-02 | High | 23 sites shared with "Everyone except external users", including finance and HR | E-02 | Restrict to named groups and confirm owners before any Copilot rollout. |
| F-03 | Medium | 61 sites have fewer than two owners | E-05 | Name at least two owners per site and consider a site ownership policy. |
| F-04 | Medium | 9 teams have 40 or more guests and no review | E-03 | Review guests per team and set a regular review. |
| F-05 | Medium | Sensitivity labels applied to about 4% of files | E-04 | Set a default label for key libraries and plan labelling for the highest-risk content. |
| F-06 | Low | 120 sites inactive for over a year | E-02 | Review with owners; archive or delete under a retention decision. |
Fix first
- Restrict the 23 broadly shared sites Effort: Medium.
- Change the organisation-level default Effort: Low.
- Name owners for the 61 thinly owned sites Effort: Medium.
- Review guests in the 9 teams Effort: Low.
- Plan default labels for key libraries Effort: High.
30/60/90-day plan
- First 30 days: Restrict the 23 sites; change the default link type; start the guest review.
- By 60 days: Name owners; set a group expiration policy; default labels on key libraries.
- By 90 days: Re-run the sharing and permissions reports; review inactive sites; agree a quarterly governance review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.