Choosing a SharePoint Support Provider: 20-Question Vendor Scorecard

Choosing a SharePoint support provider is a five-figure to seven-figure annual decision that most enterprises make with two hours of research and a gut feel. The result: 40% of enterprises we speak to have switched SharePoint support providers in the last three years, usually after a failed incident where the vendor's response fell so far short of what was needed that leadership lost confidence.

The scorecard below is what we hand to enterprises who ask "how do we tell if a vendor is any good?" It has 20 questions across 5 pillars — Response Time SLA, Escalation Path, Copilot Expertise, Compliance Experience, and Transparency. Each question has a 0-5 scoring rubric with named answer patterns. Total possible: 100 points. At the end there is an interpretation guide.

Use this alongside an RFP if you are formally procuring, or standalone if you are evaluating a single vendor a colleague recommended. Either way, the goal is to force specifics into what is otherwise a vague sales conversation.

How the scorecard works

Each question scores 0-5:

• 0 — No answer, refusal, or clearly wrong
• 1 — Vague or generic answer
• 2 — Partial answer with material gaps
• 3 — Adequate answer, meets baseline enterprise expectations
• 4 — Strong answer with specific evidence
• 5 — Exceptional answer with named metrics, case studies, or documented processes

Total possible: 100 points. Score interpretation is at the end of the article.

The right way to run this: send the 20 questions to the vendor in advance, then have a 90-minute call where they walk through their answers with evidence. Score during and after the call, not from written responses alone — written responses can be ghostwritten by marketing, live conversations cannot.

Pillar 1 — Response Time SLA (4 questions)

Q1. What is your written response time SLA for a P1 (production down) incident, in minutes?

Scoring:

• 5 — 15 minutes or less, paged 24x7, penalty for miss
• 4 — 30 minutes, paged 24x7
• 3 — 1 hour, paged during business hours
• 2 — 4 hours, business hours only
• 1 — "Same day" or "as fast as possible"
• 0 — No written SLA

Red flag: "We can respond within business hours" is not enterprise-grade. Real production issues do not respect business hours.

Q2. What is your written resolution time SLA for a P1 incident?

Scoring:

• 5 — 4 hours with named engineer, or workaround within 4 hours if Microsoft support required
• 4 — 8 hours resolution or workaround
• 3 — 24 hours resolution
• 2 — Best effort, no committed time
• 1 — "Depends on the issue" as the whole answer
• 0 — No resolution SLA at all

Red flag: Vendors who commit to response but not resolution are answering the phone but not fixing the problem.

Q3. What compensation or credit do you provide if you miss an SLA?

Scoring:

• 5 — Contractual credit tied to specific miss thresholds
• 4 — Credit at vendor discretion with published policy
• 3 — Case-by-case remediation
• 2 — Vague "we make it right" answer
• 1 — Escalation path only, no credit
• 0 — No accountability for misses

Red flag: No financial accountability for SLA misses signals that the vendor treats SLAs as marketing rather than commitment.

Q4. What is your average measured response time and resolution time over the last 12 months for P1 incidents?

Scoring:

• 5 — Specific numbers with methodology, better than SLA
• 4 — Specific numbers, at SLA
• 3 — Approximate numbers
• 2 — "We meet our SLAs" without numbers
• 1 — Refuses to share
• 0 — Does not measure

Red flag: Vendors that do not measure their own SLA performance do not know if they are meeting it.

Pillar 2 — Escalation Path (4 questions)

Q5. Describe your on-call rotation and staffing model.

Scoring:

• 5 — 24x7 primary and secondary rotation, named senior consultants, documented handoff
• 4 — 24x7 with primary rotation
• 3 — Extended business hours (12-16 hour window)
• 2 — Business hours only with best-effort after-hours
• 1 — Business hours only
• 0 — No on-call model

Red flag: Vendors that describe on-call as "we all answer our phones" have no rotation and burn out fast.

Q6. What is the escalation path if the first responder cannot resolve an issue?

Scoring:

• 5 — Named escalation contacts at 3+ levels, trigger criteria defined, response SLA at each level
• 4 — 2 escalation levels defined with named contacts
• 3 — Escalation exists but not always to a named person
• 2 — "We escalate as needed"
• 1 — No formal escalation path
• 0 — Refuses to answer

Red flag: "We handle escalation internally" is not an answer. You need to know who is answering the phone at 2am.

Q7. What is your process for engaging Microsoft support (Premier or Unified) when an issue requires it?

Scoring:

• 5 — Named Premier/Unified relationship, documented engagement process, average time-to-open ticket less than 30 minutes
• 4 — Premier/Unified access, documented process
• 3 — Standard Microsoft support access
• 2 — Client opens their own Microsoft ticket, vendor supports
• 1 — Ad-hoc Microsoft engagement
• 0 — No Microsoft support relationship

Red flag: SharePoint issues that need product-level Microsoft engagement are not rare. A vendor without a Premier relationship will slow you down at the worst moment.

Q8. Provide a case study of a P1 incident from the last 12 months where escalation was invoked.

Scoring:

• 5 — Specific incident, timeline, escalation triggered, resolution, lessons learned
• 4 — Specific incident with less detail
• 3 — Generic case study with some specifics
• 2 — Marketing-style case study
• 1 — Refuses to share
• 0 — "We have not had P1 incidents"

Red flag: Every vendor with real enterprise clients has had P1 incidents. Denying it means they are lying or their client base is too small to be relevant. Our emergency support service documents specific escalation patterns publicly for exactly this reason.

Pillar 3 — Copilot Expertise (4 questions)

Q9. How many SharePoint Copilot Agents deployments has your firm supported in production, and what is the total user count?

Scoring:

• 5 — Named deployments, more than 10 in production, more than 20,000 total users
• 4 — 5-10 deployments in production
• 3 — 2-4 deployments
• 2 — 1 deployment or "in pilot"
• 1 — "We are exploring Copilot"
• 0 — Does not support Copilot

Red flag: "We are ready for Copilot" without a single production deployment means you are their pilot.

Q10. Describe your Copilot cost management approach and provide a sample monthly cost report.

Scoring:

• 5 — Named cost framework, sample report with per-agent cost breakdown, budget alert workflow
• 4 — Cost framework and monthly reporting
• 3 — Cost tracked but no framework
• 2 — Cost visible in Azure only, no vendor reporting
• 1 — "Microsoft handles cost tracking"
• 0 — No cost management approach

Red flag: Vendors that treat Copilot cost as "the client's problem" will miss cost overruns until they are enormous.

Q11. What is your process for Copilot governance (labeling, oversharing audit, agent lifecycle)?

Scoring:

• 5 — Documented governance charter template, oversharing audit process, agent lifecycle policy
• 4 — Governance approach with case studies
• 3 — Governance discussed but no framework
• 2 — "We follow Microsoft best practices"
• 1 — No governance approach
• 0 — "Copilot governance is client's responsibility"

Red flag: Vendors without a governance framework produce Copilot deployments that leak information for months before the enterprise notices. See our SharePoint Copilot service for the full framework structure we look for.

Q12. How do you handle a Copilot Agents cost overrun incident (200% or more over budget)?

Scoring:

• 5 — Named incident response process, immediate quota reduction, root cause analysis, cost recovery plan
• 4 — Documented response process
• 3 — Case-by-case handling
• 2 — "We work with the client"
• 1 — Vague answer
• 0 — Has not encountered this (they will, everyone does)

Red flag: Vendors that have not seen a cost overrun have either not deployed Copilot at scale or are not measuring cost.

Pillar 4 — Compliance Experience (4 questions)

Q13. What is your firm's experience with the specific regulations that apply to our industry?

Scoring:

• 5 — Named engagements, specific control mappings, audit outcomes for our regulations
• 4 — Multiple engagements in our industry with specific regulations named
• 3 — Some experience with our regulations
• 2 — General compliance experience, not our specific regulations
• 1 — "We are aware of compliance requirements"
• 0 — No relevant compliance experience

Red flag: Generic "compliance experience" without naming specific regulations means the vendor has not done regulated work.

Q14. Describe your Purview retention deployment methodology.

Scoring:

• 5 — Named methodology, event-based retention experience, regulatory record configurations, audit deliverables
• 4 — Purview experience with named case studies
• 3 — Purview experience described generally
• 2 — "We have used Purview"
• 1 — Retention treated as classic SharePoint retention only
• 0 — No Purview experience

Red flag: Vendors still recommending classic SharePoint retention in 2026 are not tracking Microsoft's product direction.

Q15. How do you handle sensitivity labeling deployment for a regulated tenant?

Scoring:

• 5 — Named auto-labeling policy design process, sensitive-info-type customization, simulation-before-enforce methodology, coverage targets
• 4 — Labeling approach with case studies
• 3 — Labeling discussed but no framework
• 2 — "We enable Microsoft's default labels"
• 1 — Labeling treated as user opt-in
• 0 — No labeling approach

Red flag: Enterprises with more than 40% unlabeled content after 6 months of a deployment usually had a vendor scoring 0-2 here.

Q16. Provide references from clients in our regulated industry.

Scoring:

• 5 — Three or more references, all in our industry, willing to schedule calls
• 4 — Two references in our industry
• 3 — One reference in our industry, others adjacent
• 2 — No references in our industry, only adjacent
• 1 — References only from other industries
• 0 — Refuses to provide references

Red flag: No references in your industry after asking for them is disqualifying for regulated work.

Pillar 5 — Transparency (4 questions)

Q17. Provide a published rate card or transparent pricing structure.

Scoring:

• 5 — Published rate card by consultant level, transparent hourly/monthly rates
• 4 — Rate card provided in RFP response
• 3 — Rate card provided on request
• 2 — Rates discussed generally, not documented
• 1 — Rates confidential until contracting
• 0 — Refuses to share pricing

Red flag: Vendors that hide pricing until contracting are usually expensive vendors trying to prevent competitive shopping.

Q18. Describe your monthly reporting cadence and deliverables.

Scoring:

• 5 — Sample monthly report provided, named metrics, executive summary, trend analysis
• 4 — Detailed monthly reporting described
• 3 — Basic monthly report described
• 2 — Quarterly reporting only
• 1 — Reporting on request only
• 0 — No systematic reporting

Red flag: No systematic reporting means you will not know how the vendor is performing until something breaks.

Q19. Can we speak to three current clients without vendor prescreening?

Scoring:

• 5 — Yes, unfiltered access to references
• 4 — Yes, references provided within 48 hours
• 3 — Yes, with vendor introduction
• 2 — References provided but limited
• 1 — References only after contract signing
• 0 — Refuses reference access

Red flag: Vendors that insist on prescreening reference calls are managing what you hear.

Q20. What is your policy on client-owned data, IP, and documentation at contract end?

Scoring:

• 5 — All client data returned, all documentation transferred, IP explicitly client-owned, transition support included
• 4 — Data and documentation transferred at contract end
• 3 — Data returned but documentation limited
• 2 — Transition negotiated case-by-case
• 1 — Vague answer
• 0 — Vendor retains ownership of documentation or configurations

Red flag: Vendors that retain IP or documentation are trying to make you dependent — the same reason airlines make miles hard to transfer. This is often the most important question in the scorecard.

Total score interpretation

Add scores from all 20 questions. Total possible: 100.

| Score band | Interpretation | Action |

|---|---|---|

| 71-100 | Enterprise-ready | Strong candidate. Reference calls confirm the top 5-10 signals. |

| 41-70 | Conditional | Consider if pricing is compelling. Focus negotiation on the categories where they scored below 3. |

| Below 40 | Avoid | Structural gaps that cannot be closed in contract negotiation. Move on. |

The three questions that matter most

If you can only ask three:

• Q6 — Escalation path. Everything else is theater if you cannot reach a decision-maker at 2am.
• Q11 — Copilot governance. If Copilot is or will be in scope, this is where the vendor's real capability shows.
• Q20 — IP and data ownership at exit. This is the answer that reveals whether the vendor is optimizing for your outcome or theirs.

The vendor claim we hear most that means the least

"We are white-glove." Every vendor says this. It has no meaning without specifics. The scorecard forces specifics. If a vendor scores well on the scorecard, they are white-glove. If they score poorly, they are not — regardless of marketing.

Expert help from our SharePoint consultants

We offer to complete this scorecard on ourselves during discovery calls with prospective clients — same 20 questions, same 0-5 rubric, same evidence expected. If you would like our answers to compare against other vendors you are evaluating, or you want us to help you facilitate the scorecard with your shortlist, reach out through our SharePoint consulting service or contact us. We would rather you run a rigorous evaluation than pick a vendor on a gut feel — the outcome is better for you either way, and we prefer to win on evidence.