FIELD NOTE / MICROSOFT 365 / GOVERNANCE
Microsoft 365 governance begins with named owners and inspectable controls
A tenant can contain hundreds of configured controls while nobody can answer four operational questions: who approved the setting, which resources it affects, what exception remains, and which current result shows it still works. The baseline starts by acquiring those objects under read-only authority and assigning each exception to a person and review date.
Name the tenant, authority and capture time
Record the tenant ID, verified domains, cloud, capture UTC, operator object ID and delegated scopes. Use a dedicated read-only assessment identity. Store command output in an access-controlled case folder and hash the raw exports before analysis.
For Microsoft Graph PowerShell, request only the scopes needed for the inventory, such as Directory.Read.All, RoleManagement.Read.Directory, Application.Read.All and the approved SharePoint scope. The consent record belongs in the evidence pack.
Resolve privileged role assignments to people and expiry
Acquire active and eligible role assignments, including PIM schedule instances. Retain assignment ID, principal ID, role definition ID, member type, start and end. Resolve each principal to a user, group, service principal or managed identity. A deleted principal ID is an exception requiring investigation.
Connect-MgGraph -Scopes 'RoleManagement.Read.Directory','Directory.Read.All'
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All |
Select-Object Id,PrincipalId,RoleDefinitionId,MemberType,StartDateTime,EndDateTimeTest one prohibited administrative action with an approved low-privilege account. A role inventory without an effective denial test leaves the main risk unmeasured.
Inspect application roles and credentials separately
For each production service principal, capture owners, app-role assignments, delegated grants, federated credentials, certificate expiry and sign-in activity. Distinguish an application registration from its tenant service principal. The object IDs and permissions answer different questions.
Flag tenant-wide roles such as Sites.ReadWrite.All where the written purpose names one site. Follow the Graph Selected-permission review and prove a 403 against an unrelated site after the broad role is removed and the token is renewed.
Inventory Power Platform production authority
Record environment ID, type, region, managed status, Dataverse URL, security group, DLP policy, environment admins, makers, production apps, flows, gateways, connection owners and solution state. Classify the default environment explicitly.
Join flows to connection references, connections and owners. An offboarding control should query flows and apps linked to the departing object ID before the account is blocked. The recovery test uses a non-production owner disablement and confirms that the backup operator can locate, run and restore the workload.
Separate protection, retention, records and movement
Capture sensitivity labels and publication state, retention policies and rules, record labels, DLP policies, eDiscovery or hold dependencies and their targeted locations. Join each control to the information class and owner that authorised it.
Run item-level tests. Apply the expected sensitivity label, verify external and unmanaged-device behaviour, confirm the independent retention result, then test disposal under the approved schedule. A label name supplies vocabulary; the audit and item state supply the result.
Turn findings into expiring exceptions
Each exception records resource ID, current value, required value, business reason, owner, approver, evidence link, review date and expiry. Use stable IDs so a rename updates the display name on the existing record.
The monthly meeting closes expired grants, stale guest sponsorship, abandoned connections and failed controls. Trend counts support prioritisation, but every material closure requires a new result from the affected system.
Prove that another operator can reproduce the baseline
A second administrator follows the runbook with the documented scopes, regenerates the inventories and explains every material difference. They repeat one positive and one prohibited test per high-risk control family. Record tool versions, UTC times, request IDs and redaction decisions.
This baseline covers the sampled controls and identities at the capture time. It cannot certify every workload or future Microsoft default. The review cadence and exception register keep that limitation visible.