How fast can you respond to a SharePoint production outage?

Support-plan customers get a 15-minute acknowledgement on severity-1 outages through the on-call rotation, with an engineer actively troubleshooting inside 60 minutes twenty-four hours a day. Severity-1 is reserved for tenant-wide inaccessibility, authentication failure, data loss, or search index corruption affecting production business processes. Severity-2 (feature broken for a specific department) is acknowledged inside one business hour. For ad-hoc emergency engagements without an existing contract, an engineer can typically be on a bridge within two hours during US business hours after the engagement agreement is signed. Every incident produces a written root-cause analysis within five business days, including the Microsoft 365 Service Health correlation ID where applicable, change-management entries reviewed, and a hardening recommendation so the same issue does not recur.

What does a tenant-to-tenant SharePoint migration look like?

Tenant-to-tenant migrations run in four phases. Discovery inventories every site collection, OneDrive, Teams, Planner plan, group calendar, and permission assignment, and maps source-to-target identities. Pre-migration remediation fixes unsupported items — external sharing links, orphaned permissions, oversize files, legacy InfoPath forms, and classic workflows — before the first byte moves. Migration executes in waves grouped by business unit, using a combination of ShareGate, Quest On Demand, or native Microsoft cross-tenant tooling depending on scope, content types, and identity model. Cutover runs on a weekend window with delta-sync passes on Friday evening and Sunday morning. Post-migration includes URL mapping for internal links, email communication to end users, guest-access re-invites, and a 30-day hypercare period where an engineer triages every reported issue inside the same day.

How is a SharePoint consulting engagement priced?

Three models fit most organizations. Fixed-fee project pricing works for scoped deliverables — a migration, an intranet rebuild, a branding refresh, or a governance rollout — where requirements can be documented up front. Time-and-materials applies to exploratory work and long-tail enhancements where the backlog changes monthly. Retainer support (priced in hours-per-month tiers from 20 to 200 hours) covers ongoing administration, ticket handling, minor customizations, user training, and emergency response with a guaranteed SLA. Migration scope is typically priced per seat or per gigabyte depending on complexity. Every proposal itemizes what is and is not included, so procurement teams can baseline the quote against competing bids. Microsoft 365 license costs are quoted separately and are not marked up.

Do you support SharePoint Framework (SPFx) custom development?

Yes. SPFx work includes web parts, extensions, field customizers, application customizers, and adaptive card extensions targeting the modern Viva Connections surface. Build pipelines run on Node LTS aligned to the current SPFx generator, with solution packaging, CDN hosting on SharePoint Online or Azure Front Door, and automated deployment through the App Catalog. Every solution ships with accessibility testing (WCAG 2.1 AA), localization hooks, and logging to Application Insights so production issues are traceable. Legacy full-trust or sandbox solutions are refactored onto SPFx using a documented migration pattern rather than a rewrite-from-scratch assumption. Where modern features cannot fully replace a legacy customization, the delta is surfaced early in discovery so stakeholders can decide between a Power Platform alternative, a Graph API solution, or a redesigned business process.

How do you design SharePoint information architecture at scale?

Modern SharePoint is a flat architecture built from hub sites, not nested site collections. Design starts with a persona-driven inventory of content audiences and the tasks they perform, not an org-chart mirror. Hub sites group content by business capability (HR, Finance, Project Delivery, Customer) with a consistent navigation pattern, shared theme, and associated audience targeting. Managed metadata and site columns enforce tagging where taxonomy matters — retention, records, regulated content — while labels in Microsoft Purview drive compliance automation. Search is tuned with promoted results, refiners, and result sources so users find content in fewer clicks. Every site template is published as a site design with a PnP provisioning template, so new sites inherit branding, security, and structure automatically rather than drifting from the standard within three months.

How do you secure SharePoint and enforce Microsoft 365 governance?

Governance is written, published, and enforced by tenant policy — not by tribal knowledge. External sharing is restricted at the tenant and per-site level, with sensitivity labels controlling which sites accept guest access and which block it. Conditional access policies require compliant devices for privileged roles, and risky sign-ins trigger step-up authentication. Microsoft Purview delivers DLP for content in motion, retention labels for records management, and Communication Compliance for regulated industries. SharePoint Advanced Management surfaces oversharing reports, inactive site detection, and restricted-access control for high-value sites. Every tenant gets a written governance charter covering provisioning workflow, naming standards, site lifecycle, backup and restore responsibilities, and the audit cadence. Quarterly governance reviews track policy drift and adjust controls against emerging Microsoft 365 features.

What are the options for migrating from SharePoint on-premises?

SharePoint 2013, 2016, and 2019 all move to SharePoint Online, but the migration path depends on starting version, customization footprint, and data volume. Native Microsoft migration tools cover the majority of document libraries, lists, and permissions. SharePoint Migration Tool handles straightforward farms; the Migration Manager agent model suits large distributed environments. Third-party platforms (ShareGate, Quest, AvePoint) are preferred for complex permission remapping, nested content types, or large metadata hierarchies. InfoPath forms, classic workflows, and full-trust code are evaluated case by case and converted to Power Apps, Power Automate, or SPFx. 2013 workflow is retired from Microsoft 365, so migration plans explicitly schedule workflow replacement. Content older than a retention threshold is archived to Microsoft 365 Archive or Azure Storage rather than moved, reducing target footprint by 20–40 percent on average.

Can you integrate Microsoft 365 Copilot with SharePoint content?

Yes, with governance preceding enablement. Copilot surfaces any content a user can already access through SharePoint, OneDrive, and Teams, so permission hygiene and sensitivity labeling have to be completed before enablement — not afterwards. Integration work covers three tracks. First, SharePoint cleanup: oversharing detection, broken-inheritance remediation, restricted SharePoint search for sites still in flight. Second, content enrichment: sensitivity labels applied at scale, retention policies aligned to record classes, and managed metadata reintroduced for high-value libraries so Copilot has better retrieval signals. Third, operational control: DSPM for AI in Microsoft Purview, Copilot audit log review, and ongoing monitoring of AI-generated activity. Each track produces a before-and-after evidence pack so executive sponsors can see that enablement was controlled, not opportunistic.

What qualifications and experience do your consultants have?

Engineers assigned to client engagements hold current Microsoft 365 certifications (Modern Desktop Administrator, Teams Administrator, Identity and Access Administrator, Security Administrator) plus SharePoint-specific depth — multiple people on the bench have supported SharePoint since the 2007 product cycle. The team includes former Microsoft Most Valuable Professionals, community conference speakers, and active contributors to the PnP community initiative. Every consultant rotates through a quarterly internal lab to rehearse outage scenarios, new Microsoft 365 feature rollouts, and hands-on migration drills. Staffing decisions match the engagement profile: compliance-regulated clients are staffed with engineers who have delivered in that exact vertical before, not generalists. Every project has a named technical lead and a named delivery lead so escalation paths are obvious from day one.

Is the support service offered in multiple languages or time zones?

Support coverage spans US Eastern, US Pacific, UK, and Asia-Pacific time zones through a follow-the-sun rotation for retainer clients on the 24/7 tier. Primary support language is English, with working proficiency in Spanish and French available on a best-effort basis. For clients with strict language requirements, a named engineer can be matched for the duration of the engagement. Ticket submission is available through email, a web portal, and a Teams-integrated bot; severity-1 issues additionally escalate to an on-call phone bridge. All tickets are tracked in a shared ITSM platform with visibility for the client, and monthly service reviews report on SLA attainment, ticket volume trends, and any patterns that justify a proactive hardening project rather than repeated break/fix work.

SharePoint Site Owner Responsibilities: 30-Item Governance Checklist

The phrase "you are a site owner now" arrives in the inbox with almost no warning. Two hours later the same person is being asked why an external vendor can see a folder called *Board Materials*, why 12 GB of duplicate PDFs appeared last month, and why the search bar returns nothing useful. Site ownership is not a certificate — it is a recurring operational job. This 30-item checklist is what we hand new site owners on day one, and what we grade against every quarter during our SharePoint consulting engagements.

Why site owners fail (and why it is rarely their fault)

Most site owners inherit a site with no documentation, no audit history, and no clear boundary between what they can fix and what belongs to the tenant admin. Governance debt then compounds: the owner is blamed for a permission incident that was seeded three org restructures ago. The fix is not more training decks. The fix is a written checklist, a written cadence, and a written escalation path — the three artifacts most tenants do not have.

SharePoint governance framework showing policies, roles, and compliance — SharePoint governance model with policies and compliance controls

We group the 30 items into five categories: Access, Content Lifecycle, Compliance, Onboarding & Offboarding, and Health. Each item has an owner, a frequency, and an evidence trail so an auditor can see it was performed.

Category 1: Access (items 1-8)

Access is the single largest source of incidents on any modern SharePoint site. If you only get one category right this year, get this one.

|---|------|---------|----------|

Two of these are quietly the highest risk: item 4 (external links) and item 3 (unique permissions). We regularly find sites where a single 2022 "share with a specific person" is still active for someone who left the client four employers ago. A monthly review takes ten minutes. Skipping it costs a compliance finding.

For the boundary of what a site owner can do vs must escalate, see the official site owner permission management guide.

Category 2: Content Lifecycle (items 9-15)

Content grows silently until a quota alert or a legal hold changes the conversation.

9. Confirm the site's retention policy is applied and check the Applied Retention Policies list quarterly.
10. Review large files (>100 MB) monthly — one runaway video export can consume a month of storage growth.
11. Check version-history configuration on high-churn libraries. Default is 500 major versions; for a 40 MB PowerPoint deck edited multiple times a day, that is 20 GB per file per year.
12. Archive completed project sites using the built-in Archive feature or a Purview policy — do not leave them as live sites.
13. Review the Recycle Bin (both stages) monthly and empty items past their business need.
14. Confirm content types are still relevant — an unused content type is a signal the taxonomy has drifted from real work.
15. Run a stale-content report (last modified > 24 months) and either archive, delete or refresh.

A worked example we use often: a client's HR site had version history at *unlimited* on a 60 GB "policies" library. Reducing to 50 major versions and running the version-cleanup timer reclaimed 41 GB in a single week without losing a single business-relevant version. Storage remediation almost always lives here, not in "buy more quota."

Category 3: Compliance (items 16-22)

Compliance items are the ones auditors ask about, and the ones site owners are most often unprepared for.

16. Confirm the sensitivity label applied to the site and that it propagates to Teams, Groups and OneDrive attachments where applicable.
17. Verify DLP policy coverage — if the site holds regulated data, at least one DLP policy should match its content types.
18. Confirm eDiscovery holds are documented — site owners should not delete content on a hold. Escalate to Legal if unsure.
19. Review audit log settings and confirm Purview is capturing site-level events (SharePointFileOperation, SharingSet, PermissionModified).
20. Check that guest expiration is enabled at the tenant level (site owner surfaces this to the tenant admin — see escalation runbook below).
21. Document the site's data classification in a one-page site profile stored inside the site itself.
22. Confirm records management is enabled for libraries where regulated content lives (e.g., contracts, HR records).

If your organization is subject to industry-specific regulation, coordinate with our document management team on labeling scheme design before rolling this out.

Category 4: Onboarding & Offboarding (items 23-27)

The most common security incident we investigate on modern SharePoint is a departed employee retaining access to a "shared with specific people" link. This category exists to make that impossible.

23. New joiners — add to the correct group (Members, Visitors), never as a direct permission on the site or a subsite.
24. Role changes — remove from prior groups the same day the role changes, then add to the new group.
25. Leavers — confirm the leaver is removed from all site groups, all "specific people" shares, and all guest links, within one business day of the offboarding ticket.
26. Vendor and contractor cycles — set a review date, a business owner, and an automatic expiration if the tenant supports it.
27. External guest lifecycle — quarterly guest audit, disable any guest whose sponsor has left, remove any guest with no activity for 180 days.

We build these into the client HRIS integration where possible. When that is not available, a quarterly export from Microsoft Entra ID cross-referenced with SharePoint group membership will catch the drift.

Category 5: Health (items 28-30)

The last three items are the ones that keep the site usable.

28. Homepage health — headings render, imagery loads, no orphaned news posts pinned from three years ago. A stale homepage is why users abandon the site and start emailing attachments again.
29. Search relevance — quarterly, run five common queries a user would run on this site and record whether the top 3 results are correct. If not, escalate to the search admin (see the runbook below).
30. Analytics review — check Site Usage monthly. If unique visitors trend below 5 per month for two consecutive quarters, either promote the site, retire it, or merge it into a hub.

For homepage and navigation guidance, the communication site management guide covers the mechanics.

RACI: who does what

The most common source of governance failure is not a missing checklist item — it is confusion over who owns it.

|-------------|:----------:|:----:|:------------:|:------------------:|

| Adjust group membership | R | A | I | I |

| Break/repair permission inheritance | R | A | I | C |

| Create/rename subsites and libraries | R | A | I | I |

| Change site-level sharing settings | R | A | C | I |

| Change tenant-level sharing/guest policy | I | I | R/A | C |

| Apply retention labels | R | C | I | A |

| Configure DLP policy scope | I | I | R | A |

| Run an eDiscovery hold | I | I | C | R/A |

| Search schema changes (managed properties) | I | C | R/A | I |

| Storage quota changes | I | I | R/A | I |

| Site archive/deletion | R | A | C | C |

R = Responsible, A = Accountable, C = Consulted, I = Informed.

Escalation runbook: what site owners CANNOT resolve

Site owners often waste hours trying to fix things that only the tenant admin can. This is the boundary we teach.

Open a tenant ticket for: search index freshness across sites, tenant-wide sharing settings, guest access policies, DLP policy scope, storage pool tuning, and any managed metadata term-store change that spans multiple sites.
Open a compliance ticket for: retention label creation, eDiscovery hold placement, sensitivity label taxonomy changes, and DLP false-positive tuning.
Handle at the site level: group memberships, unique permissions, sharing links from your site, sensitivity label application to files (not creation), site navigation, homepage content, list/library configuration, and content type application (not creation of enterprise-wide types).

If your team needs help drawing this boundary formally for the whole tenant, our SharePoint support practice runs governance workshops that produce a written runbook per environment.

Quarterly cadence at a glance

Weekly: items 4, 7 (external links, access requests).
Monthly: items 1, 2, 10, 13, 28, 30.
Quarterly: items 3, 5, 6, 8, 9, 11, 14, 15, 16, 17, 20, 22, 27, 29.
Ad hoc: items 12, 18, 19, 21, 23-26 (event-driven).

Print this. Post it. Track it in a governance list on the site itself. If you can hand your successor a filled-in copy of this checklist from the last four quarters, you have done the job.

FAQ

Expert help from our SharePoint consultants

Site ownership only scales when governance is written down. If your team is inheriting sprawling sites, unclear ownership, or a tenant with no cadence, our SharePoint consulting team runs one-day governance workshops that produce the RACI, the cadence, and the escalation runbook for your environment. Reach out via our contact page and we will scope a session.

Share this article:

Written by the SharePoint Support Team

Senior SharePoint Consultants | 25+ Years Microsoft Ecosystem Experience

Our senior SharePoint consultants bring deep expertise spanning 500+ enterprise migrations and compliance implementations across HIPAA, SOC 2, and FedRAMP environments. We cover SharePoint Online, Microsoft 365, migrations, Copilot readiness, and large-scale governance.

Expert SharePoint Services

SharePoint Governance Consulting Document Management Government Solutions

View pricing →Read our FAQ →See case studies →

Frequently Asked Questions

What is the difference between a SharePoint site owner and a site collection administrator?▼

A site owner has full control of a single site and its subsites — permissions, content, navigation, homepage, groups. A site collection administrator has full control of the entire site collection including the root site, all subsites, and administrative settings that a site owner cannot see or change. Site collection administrators can override site owner permissions in an incident. In modern SharePoint Online, most sites are their own site collection, so the two roles overlap heavily, but the distinction still matters for classic sites and for hub-linked architectures. Assign site collection admin sparingly and log every assignment.

How often should a SharePoint site owner audit external sharing?▼

Weekly for high-sensitivity sites (HR, Legal, Finance, executive) and monthly for standard-sensitivity sites. Use the external sharing report from the site info panel or the Purview external sharing report. The point is not to eliminate external sharing — the point is to make sure every active external link has a current business justification and a named internal sponsor. We flag any link older than 90 days with no recorded activity for a decision: renew, revoke, or convert to a governed guest account.

Can a site owner delete or restore items during an eDiscovery hold?▼

No. When a site or content location is subject to an eDiscovery hold, deletions are preserved in a preservation library invisible to the site owner, and no site-level action can remove them from that library. Attempting to delete content on hold is not blocked by the UI in every case, so a site owner may believe the delete succeeded — but the content is preserved for the hold duration regardless. If Legal has notified you a site is on hold, coordinate all cleanup and archival with Compliance before running any bulk operations.

What is the correct escalation path if SharePoint search is not returning current results?▼

Site owners should first confirm the file is not in a library with search excluded, that the user has permission (permission-trimmed search will hide items the user cannot access), and that the file was modified more than 24 hours ago (crawl freshness). If the answer is still wrong, escalate to the tenant admin with the exact query, the expected result URL, and the user who ran the query. Tenant admins can inspect crawled properties, managed property mappings, and re-index the site. Site owners cannot force a re-crawl.

How do you handle a site owner who leaves the company suddenly?▼

Every site should have at least two named owners — one primary, one secondary — and both should be documented in a site profile page inside the site. When the primary leaves, the offboarding process should trigger reassignment within one business day: the site collection administrator temporarily backfills, the site owner group loses the departing user, and a new secondary owner is nominated within 14 days. Never leave a site with a single owner; when that owner leaves, ownership can end up with an administrator who does not know the business context.

Should site owners have direct access to modify the term store?▼

No. The term store is a tenant-wide taxonomy. Even a well-meaning site owner adding a term to a global set can propagate to hundreds of sites and libraries. Site owners can request new terms via the term-store admin, and can create site-scoped term sets for terminology unique to their site. Global taxonomy changes go through a governance council or a designated taxonomy owner. This one boundary prevents most metadata drift incidents.

What evidence should a site owner keep for a governance audit?▼

For each quarterly review, keep: an export of site group memberships, the external sharing report, the unique-permissions report, the retention label coverage report, the site usage report, and a one-page summary of decisions made during the review (what was renewed, revoked, archived, escalated). Store these in a governance library inside the site itself, with retention set to seven years. An auditor asking "how did you know external access was appropriate on Q2 2026" wants to see the artifact, not your memory.

Need Expert Help?

Our SharePoint consultants are ready to help you implement these strategies in your organization.

Get a Free Consultation View Pricing

Continue Reading in Governance

Governance