For many organizations, Microsoft 365 is the business operating system. It holds your email and your most important documents, and it keeps the whole workforce productive. Yet for a system of that importance, it is often neglected compared to line-of-business applications.
M365 is often monitored by a small team of IT people who handle it on the side. Most of the time this is fine, because Microsoft 365 keeps running with little effort. However, the question is when, not if, this pile of problems will start mounting up and cause business harm.
This guide walks through how to set up automated access reviews for Teams, Groups, and SharePoint sites, and the steps you need to get there. The goal is a repeatable process that keeps access under control without constant IT intervention.
Start by building an inventory of the SharePoint sites, Microsoft 365 Groups, and Teams that will need a review. While there are many other workloads in Microsoft 365, these three are the most commonly used. It is important to understand the similarities and differences between them.
All three ultimately use SharePoint as their file storage. Groups build on top of that by adding an email communication layer, and Teams serve as a chat and video conferencing layer. The mechanics of the review differ slightly for each, but files access is the most important item, and all files live in SharePoint.
These types of workspaces are the main source of sprawl in Microsoft 365 tenants. Syskit Point telemetry from thousands of customers shows one team, group, or site for every two users, and 10% of those workspaces are shared externally. That ratio is why workspace reviews are an important task for every IT team.
To start with your inventory, gather the critical information first:
Where you can, also collect:
To gather all this information, you will have to rely on the Microsoft 365 admin centers or use PowerShell. Consider automating some of this work, because for a large estate it can take a long time to build such an inventory, and even longer to maintain it.
If you are new to this, gathering all this information is not going to be easy. Microsoft 365 is a complex ecosystem that has evolved over the years, so the data admins need is spread across various places and apps. Similar bits of information can also overlap from one admin center to another.
Here are your key resources (replace your-tenant in the URLs below with your own tenant name):
On top of these default capabilities, there are additional features available as part of premium licenses:
The data gathered in the previous steps is an important baseline that helps you determine the risk for each workspace. Ideally, the risk categories align with the sensitivity label, as shown in the table below. While you can categorize your workspaces using various techniques, such as site properties or your own inventory list, sensitivity labels are the way to go.
Sensitivity labels are the feature of Microsoft Purview. Beyond basic labeling, they enable data loss prevention (DLP) and encryption controls for files and emails.
As part of categorization, you can determine which labels truly represent sensitive data and how often that data should be reviewed, which is the basis for a proper governance plan.
Here is an example of how labels map to risk and review cadence.
| Label | Risk | Review Cadence | Sensitive |
|---|---|---|---|
| Public | Low | No review | No |
| Internal | Medium | Quarterly | No |
| Confidential | High | Monthly | Yes |
| Highly Confidential | Critical | Monthly | Yes |
Based on this information, you should be able to calculate the risk for each workspace. The risk determines how often the review should be conducted.
| Field | Workspace A | Workspace B | Workspace C |
|---|---|---|---|
| Workspace Name | Finance Quarterly Reports | Product Launch Team | HR Policy Hub |
| Workspace Type | SharePoint | Team | Group |
| Sharing Settings | Existing guests only | New and existing guests | Internal only |
| Owners | Priya Sharma; Daniel Kim | Fatima Al-Mansouri; Lucas Meyer | Amina Hassan |
| Sensitivity Label | Confidential | Internal | Highly Confidential |
| Members | 18 | 42 | 11 |
| External Members | 1 | 6 | 0 |
| Shared with everyone groups | No | Yes | No |
| Last Activity | 2026-08-08 | 2026-08-10 | 2026-07-29 |
| Storage Used | 128 GB | 54 GB | 9 GB |
| Risk | Medium | High | Critical |
| Cadence | Quarterly | Monthly |
Quarterly |
Aim for two to five owners per workspace. Two is the practical minimum, so one can cover for the other during time off. For some busy workspaces you may need a few more to share the load. However, if a workspace has more than five it will be hard to keep owners accountable for anything. While some customers do have workspaces with thousands of owners, that is not manageable in the long run.
The owner should be an actual business user who works in the workspace regularly and knows what content it holds, and who can make decisions about it without asking for approval. Avoid IT admins (except on IT-related workspaces) and never use service accounts, as that is the same as having no owner and avoiding accountability.
There are different technical aspects to what an owner is when comparing a standalone SharePoint site with Groups and Teams. In a SharePoint-only environment, you have primary and secondary site collection administrators alongside an owners group. For Groups and Teams, you have a dedicated owners group that has full control over the nested SharePoint site. In the latter case, rely on that mechanism to control the underlying SharePoint site and ignore the site's own separate controls.
At this point, reviewers should run through a consistent set of control questions for each workspace. These questions are a practical baseline you can use regardless of tooling.
Every step above can be done with the native admin centers and PowerShell, but it gets hard to sustain once you have hundreds or thousands of workspaces. Syskit Point automates the parts of this process that are tedious to build and maintain by hand:
The outcome is the same repeatable process described in this guide, without the manual data gathering.
Get the inventory and ownership right first, then layer in risk-based cadence and the control questions. Each piece makes the next one easier: a clean inventory tells you what to review, accountable owners give you someone to route decisions to, and consistent questions produce the evidence auditors ask for.
The more of this you automate, the less it depends on any one person remembering to act, and the closer access management gets to running as quietly as the rest of Microsoft 365.