Microsoft 365 Governance Framework: A Practical Australian Guide
The Evoltra Microsoft 365 Governance Baseline is the assessment and implementation model used in all Evoltra governance engagements. It structures Microsoft 365 governance across eight control domains, defines four maturity levels and establishes ownership, verification and review requirements for each. It is designed for Australian organisations using Microsoft 365 as their primary productivity and collaboration platform.
The Evoltra M365 Governance Baseline is a proprietary assessment model, not a Microsoft certification or accredited industry standard. Its controls are mapped to Microsoft documentation and ACSC guidance where relevant. Controls referencing the Essential Eight are noted explicitly.
Maturity levels
Each domain is assessed against four maturity levels. Most organisations land between Level 1 and Level 2. Level 3 is the appropriate target for any organisation subject to compliance obligations, cyber insurance requirements or regular security reviews.
- 01
Level 0 - Unmanaged
No documented ownership, policy or configuration standard. Controls are absent or applied inconsistently without documentation.
- 02
Level 1 - Defined
Policy or procedure is documented. Controls may not be consistently applied or regularly verified against the documented standard.
- 03
Level 2 - Implemented
Controls are in place and consistently applied across the environment. New users and devices go through a standard onboarding process.
- 04
Level 3 - Assured
Controls are verified on a scheduled basis. Exceptions are documented with owners and review dates. Results are reported to business ownership.
01 - Identity & Access
Identity is the perimeter of the Microsoft cloud. The majority of security incidents involving Microsoft 365 originate from compromised user accounts, not from technical exploits. Identity and access controls govern how users authenticate, what access they are granted, and how privileged accounts are managed.
Business risk: A single compromised password with no additional controls gives an attacker full access to email, files, SharePoint and connected applications. Admin account compromise has significantly higher impact - full tenant control in seconds.
Key controls
- MFA enforced for all users via Conditional Access policy (not Security Defaults alone)
- Legacy authentication protocols blocked - Basic Auth, SMTP Auth where not operationally required
- Conditional Access: require MFA for all cloud app access, all users
- Global Administrator count minimised - two to three accounts maximum, not used for day-to-day work
- Break-glass accounts configured: two accounts, no MFA requirement, monitored for any sign-in activity
- Privileged Identity Management (PIM) enabled for Global Admin, Exchange Admin and SharePoint Admin roles where licence allows
- Service accounts and application registrations inventoried and reviewed - permissions scoped to minimum necessary
- Sign-in risk policies configured in Entra ID Identity Protection
02 - Device Trust
Device trust governs whether the endpoints accessing corporate data are known, managed and compliant. In a distributed workforce, corporate data is accessed from a wide range of devices across multiple operating systems and ownership models.
Business risk: Unmanaged personal devices accessing Microsoft 365 introduce unknown risk vectors. Without device compliance controls, there is no way to enforce security standards at the endpoint. Data accessed on a compromised personal device has no additional protection layer beyond the user's credentials.
Key controls
- Microsoft Intune configured and corporate devices enrolled
- Device compliance policies defined: minimum OS version, disk encryption, PIN or password requirements, antivirus active
- Conditional Access requires compliant device or hybrid Entra ID join for corporate resources
- BYOD policy defined: if personal devices are permitted, app protection policies enforced via Intune Mobile Application Management
- Microsoft Defender for Endpoint configured on enrolled devices
- Device offboarding process documented and tested - remote wipe confirmed as available
03 - Threat Protection
Threat protection covers email security, malicious content detection and security monitoring. Email remains the primary attack vector for phishing, business email compromise and malware delivery against Microsoft 365 environments.
Business risk: Without Defender configuration, phishing emails reach user inboxes, malicious links are not inspected at time of click, and email attachments are not sandboxed before opening. A single successful phishing email can compromise an account in under a minute.
Key controls
- Microsoft Defender for Microsoft 365 Plan 1 (minimum) enabled and configured
- Safe Links policy: URLs rewritten and checked at time of click
- Safe Attachments policy: attachments detonated in sandbox before delivery
- Anti-phishing policy: impersonation protection for key users and sending domains
- Anti-spam and anti-spoofing policies tuned beyond defaults
- DKIM and DMARC configured for all sending domains
- Audit logging enabled with retention period confirmed
- Security alerts routed to a monitored address and reviewed on a regular cadence
04 - Information Protection
Information protection governs how sensitive data is classified, labelled and prevented from leaving the organisation without authorisation. It is also the foundational layer that governs what Microsoft Copilot can surface and to whom.
Business risk: Without sensitivity labels and DLP policies, sensitive data - HR records, financial information, client contracts - can be shared externally without restriction. It will also be surfaced by Microsoft Copilot to any user who has access to it, regardless of whether that access was intentional or governed.
Key controls
- Sensitivity label taxonomy designed, approved and published to users
- DLP policies in place covering at minimum financial data, HR records and legally privileged content
- Auto-labelling policy configured for known sensitive content patterns
- Microsoft Purview audit enabled
- Label inheritance configured for Office documents created from labelled containers
- External sharing of labelled content controlled via label policy settings
- Insider risk management policies reviewed where licence supports
05 - Collaboration Governance
Collaboration governance covers how Teams, SharePoint and OneDrive are structured, owned and shared. Microsoft 365 defaults are permissive - external sharing is often enabled by default, Teams can be created by any user, and SharePoint sites accumulate without assigned ownership.
Business risk: Ungoverned collaboration environments develop permission sprawl, orphaned sites and excessive external sharing. This is the primary source of oversharing risk when Microsoft Copilot is deployed - Copilot operates within existing permissions and will surface broadly accessible content to any user who queries the environment.
Key controls
- SharePoint and OneDrive tenant-level external sharing setting reviewed and set to minimum necessary
- Teams creation restricted to approved groups or IT-managed process
- Microsoft 365 Groups creation policy enforced
- Site ownership requirements enforced - all production sites have at least two active owners
- Guest access policy defined: guests require approval, have expiry dates, and are reviewed regularly
- External user audit run at least quarterly
- Inactive sites and teams identified and decommissioned or archived on a regular basis
06 - Lifecycle & Records
Lifecycle and records governance covers how accounts, data and content are managed from creation through to decommission or archival. It includes the offboarding of departing employees and the retention of business records.
Business risk: Departed employees with active accounts remain accessible attack vectors. Dormant accounts are frequently targeted in credential stuffing attacks. Data without retention policies may be deleted before it can satisfy a legal or regulatory obligation, or retained indefinitely past its useful life.
Key controls
- Employee offboarding procedure documented and enforced: account disable, licence reclaim, mailbox conversion, OneDrive access transfer
- Dormant account review: accounts not signed in for 90 or more days identified and actioned
- Shared mailbox access reviewed - no individual user accounts with delegate access to shared mailboxes that have departed
- Retention policies configured for email, Teams messages, SharePoint and OneDrive
- Legal hold process documented and tested - ability to place a hold on a mailbox verified
- Service account ownership documented and reviewed annually
07 - Copilot & Agents
Copilot and AI governance covers the specific requirements for Microsoft Copilot deployment and any AI agents or plugins connected to the Microsoft 365 environment. This domain is relevant only to organisations that have deployed or are planning to deploy Microsoft Copilot.
Business risk: Copilot operates within existing permissions. Overshared data, ungoverned SharePoint sites and inconsistent sensitivity labels will be surfaced by Copilot to any user who queries the environment. AI agents can connect to external data sources and execute actions if not configured within defined governance boundaries.
Key controls
- Copilot readiness assessment completed before deployment - permissions, oversharing and labelling reviewed
- Sensitivity labels published and applied to content before Copilot is enabled for users
- Microsoft Purview AI hub reviewed and data boundary policies configured
- Oversharing remediation completed: broadly accessible sensitive content restricted before deployment
- Copilot agent deployment policy defined: which agents are approved, which data sources they may access
- User training on Copilot capabilities and data governance responsibilities completed before rollout
- Copilot interaction review process defined for compliance or HR-sensitive use cases
08 - Operational Assurance
Operational assurance covers the ongoing processes that keep the environment in a governed state over time. A well-configured environment at a point in time will drift without a process to maintain it.
Business risk: Microsoft releases significant platform changes regularly. New features are enabled by default. New users are added outside the standard process. Policy exceptions accumulate without review. Without a regular assurance cycle, governance maturity degrades without anyone noticing.
Key controls
- Microsoft Secure Score reviewed and trended on a monthly or quarterly basis
- Microsoft 365 Message Centre reviewed on a regular cadence for changes that affect security or governance configuration
- Configuration change process documented: who can approve changes, how changes are tested before enforcement
- Policy exceptions documented with named owner, business justification and review date
- Admin access reviewed and rotated on an annual basis at minimum
- Governance review scheduled at least annually with findings documented and actioned
Accuracy
Last reviewed: 8 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Assess your environment against this framework
The Microsoft 365 Health Check assesses your tenant against the Evoltra Governance Baseline and delivers a prioritised report of findings with remediation recommendations. From $2,500.
Learn more