Microsoft 365 can begin like a garage band. A few people collaborate, everybody knows what the others are doing, Teams are created when needed, SharePoint sites appear naturally, and external guests are invited without requiring complicated processes. But as the organization grows, more musicians join the band. Teams multiply, SharePoint sites accumulate, guests remain after projects end, naming conventions become inconsistent, ownership becomes unclear, and manual administration can no longer keep pace. In this episode of M365 FM, Mirko Peters talks with Heiko Brenn, Director of Product Marketing at BCC, about how Microsoft 365 governance can transform that growing collaboration environment from noise into something closer to a well-coordinated orchestra. With more than 30 years of IT experience spanning administration, consulting, Exchange, PowerShell, product management, and Microsoft 365 governance, Heiko combines technology and business perspectives with his passion for music to explain why governance should enable collaboration rather than restrict it.
GOVERNANCE IS THE BALANCE BETWEEN FREEDOM AND STRUCTURE
For Heiko, Microsoft 365 governance is fundamentally about finding the balance between creativity, freedom, and structure. Governance is often perceived as a collection of restrictions telling employees what they cannot do, but effective governance should operate differently. Employees should be able to perform their work and remain creative while the necessary rules and processes operate as unobtrusively as possible in the background. The objective is not bureaucracy for its own sake. Governance provides the framework within which people can work effectively without allowing the Microsoft 365 environment to become uncontrolled.
GOVERNANCE, SECURITY, ADMINISTRATION AND COMPLIANCE ARE NOT THE SAME THING
Governance is closely connected with security and compliance, but Heiko argues that they should not simply be treated as interchangeable concepts. Security provides foundational protections such as MFA and other technical security measures. Governance sits above that foundation and incorporates how people and business departments actually work. Finance, HR, Legal, Sales, Development, and Marketing may require different policies because their information, risks, business processes, and regulatory requirements are different. Effective governance therefore needs to translate organizational requirements into practical rules that allow employees to continue working while remaining within the company's required framework. ㅤ
THERE IS NO ONE-SIZE-FITS-ALL GOVERNANCE MODEL
Certain governance principles appear repeatedly across organizations. Ownership, lifecycle automation, policies, templates, and reporting are examples of common building blocks. The implementation, however, needs to reflect the organization itself. Guest access appropriate for Marketing may be completely inappropriate for Legal. A development team may need different collaboration rules from HR. The challenge is therefore not merely deciding that governance is required but understanding the business well enough to translate common governance principles into policies appropriate for different areas of the organization.
GOVERNANCE IS A TEAM SPORT
Another common question is who should own Microsoft 365 governance. Is it IT, Security, Compliance, Legal, leadership, or the business? Heiko's answer is that governance is a team sport. Executive sponsorship matters because governance often exists to satisfy company-wide responsibilities, including internal policies, external regulations, ISO requirements, and other legal or organizational obligations. IT and security teams provide technical expertise and operational capabilities, but line-of-business employees also need to participate because governance ultimately affects how they work. Implementing a governance product without involving these different groups does not mean governance has been solved. Technology supports governance, but people, responsibilities, business requirements, and executive sponsorship determine whether it actually works.
FROM GARAGE BAND TO SYMPHONY ORCHESTRA
Music provides the central analogy throughout the conversation. When Heiko creates music in GarageBand, the process begins creatively. There might be a drum beat, chord progression, melody, or simply an inspiring title. Creativity comes first, but eventually the song needs structure. There is an intro, verse, chorus, perhaps a pre-chorus, and an outro. Without structure, listeners can become lost. Microsoft 365 works similarly. Employees need the freedom to collaborate and create, but completely unrestricted collaboration eventually produces noise rather than harmony. The analogy becomes even stronger when more people join. A single musician can control everything personally. A band needs musicians to agree on tuning, rhythm, tempo, and the song they are playing. An orchestra containing dozens of musicians needs considerably more coordination. As Microsoft 365 grows from a few employees to thousands of users, governance increasingly performs the role of that coordination layer.
GREAT MUSICIANS CAN STILL CREATE NOISE
A particularly useful part of the analogy is that every individual musician could be excellent and the performance could still sound terrible. The drummer might be brilliant. The guitarist might be technically exceptional. The keyboard player might be world-class. But if everyone plays independently without listening to the others, the result is noise. Microsoft 365 can experience the same problem. Every department may be using Teams, SharePoint, OneDrive, and other services productively within its own area. But if everybody creates their own structures, naming approaches, guest processes, and lifecycle rules without coordination, the organization eventually develops a fragmented collaboration environment. Governance is what helps those individually productive activities work together.
SMALL COMPANIES NEED GOVERNANCE TOO
Governance is not exclusively an enterprise problem. A smaller company may need fewer policies and simpler controls, but Heiko recommends starting early rather than waiting until collaboration has already become difficult to control. His approach can essentially be summarized as think big, start small. The organization's industry also matters. A small company operating in a highly regulated environment may require stronger governance than a considerably larger organization operating under different requirements. Size influences governance complexity, but regulation, risk, information sensitivity, and business requirements can be equally important.
WHAT JAM SESSIONS TEACH US ABOUT SELF-SERVICE
A jam session appears spontaneous. Musicians join, contribute ideas, improvise, and create something together. But even improvisation normally contains structure. Someone might say, “Let's play a blues in D minor.” Immediately, the musicians have a shared framework. They understand the basic progression and can contribute creatively inside it. Microsoft 365 self-service can work in much the same way. Employees should be able to create and collaborate without submitting an IT ticket for every action, but they still benefit from common rules. Governance provides the equivalent of agreeing on the key and rhythm before everybody begins playing. Freedom works considerably better when everybody understands the basic framework.
SELF-SERVICE DOES NOT HAVE TO MEAN CHAOS
Organizations frequently react to Microsoft 365 sprawl by considering whether they should simply prevent employees from creating Teams and other workspaces. Heiko's approach is more nuanced. Organizations can introduce naming conventions, predefined templates, ownership requirements, guest policies, lifecycle controls, and other guardrails while still allowing employees to create what they need. The objective is not necessarily to centralize every Microsoft 365 action inside IT. It is to make self-service predictable and manageable. Once the guardrails are established, organizations can potentially delegate more work to line-of-business users because those users operate inside a controlled framework.
NAMING CONVENTIONS ARE A SIMPLE BUT IMPORTANT STARTING POINT
Teams environments can quickly become difficult to navigate when employees create workspaces without consistent naming. A useful naming convention can provide immediate context about the purpose, department, project, or other relevant characteristics of a workspace. The same concept can help with external guests, particularly when guest access is connected to temporary projects. These controls may appear basic compared with sophisticated security technology, but they help organizations answer fundamental operational questions: What is this workspace? Who owns it? Why does it exist? Who belongs there? And is it still needed?
GUEST ACCESS NEEDS A LIFECYCLE
External collaboration is one of Microsoft 365's major strengths, but guests frequently remain long after the reason for their access disappears. A consultant joins a six-month project. An agency collaborates with Marketing. A partner receives access to a Team. The project finishes, but nobody remembers to review the guest account. Governance needs to consider external access as something with a lifecycle rather than something granted indefinitely. Organizations need visibility into why a guest exists, what the guest can access, who is responsible for that relationship, and whether the access remains necessary.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
