Technical Overview

MICROSOFT 365 GOVERNANCE & SECURITY
Your Policy. Our Automation.
Accountability & Security Recertification
●●

●

●

●

●

●

Public Site Collection Directory – Provides a list of all sitecollections – along with corresponding business and IT
contacts, email address, classification, and storage usage– for insight into trends to determine chargeback models
while ensuring business owner accountability.
Ownership and Metadata Recertification – Ensurethat the classification and ownership of your SharePointsites remain current and accurate with periodic
recertification tasks to validate or modify metadata andownership details.
Membership and Permissions Recertification –Automatically assign key users with tasks to review andcorrect all SharePoint user permissions, Microsoft 365
Groups and Teams memberships on a scheduled basis.
Changes to permissions, and Groups and Teams
membership can be made directly in the task before
certifying compliance with organizational security policies.
Automated Renewal of Recertifications – Streamline therecertification of tasks by creating an automated single
process for renewal of ownership, classification, andpermissions of SharePoint sites, Microsoft 365 Groups andTeams with dynamic look up rules to assign proper
contacts for the renewal process.
Delegated Administration – Decentralize operational
governance and balance management workload bydelegating administrative control of the workspace withrole-based access and permissions to the defined users.
Workspace Report – View, manage and oversee all
renewal task processes and auto import history in thetenant through a single point of entry with custom filtersand built-in views.
My Tasks – View all your tasks in a single pane of glasswith full visibility of the task summary, requester, status,
type, and due date.

Approval Process
●●●

●

●

Multi-Stage Approval Process – Run multiple stages ofapproval with dynamic, role-based assignments andescalation for all provisioning, content management, andpermissions management services.
Conditional Approval Process – Define multiple possible
approval chains for a single service. Dynamically route therequest through required users based on attributes
associated with the request or the requestor—such asregion, department, or sensitivity level.
Timed Escalation – Designate an alternate approver totake over tasks that have not been resolved after adesignated period of time.
Zero-Stage Approval Process – Automatically processservices that do not need approval while ensuring
compliance with policies and auditing all services.
Actionable Messages Approval Process – Approve orreject tasks directly in email messages with one simple click.

AvePoint Cloud Management Integration●●

Automatic Provisioning – Automatically apply
appropriate change management, permissions, andlifecycle management policies to Microsoft 365 Groups,Teams, SharePoint Online sites, or site collections uponcreation through automated policy assignment based on
the requested service level.
Policy Enforcer Integration – Automatically adjust
unauthorized changes and configurations in features,permissions, and settings by applying up to 28 configurable
Policy Enforcer rules and profiles to provisioned
site collections.

MyHub Teams App●

AvePoint MyHub – A convenient one-stop-shop for
managing existing Microsoft 365 workspaces and creating
new ones—all from Microsoft Teams!

●

Workspace Management – View and locate all yourMicrosoft 365 workspaces, mark as a favorite, manage
membership, and access any of the workspace services, such as
Files, Planner, Conversations etc., all with just a few clicks.

●Workspace Hubs – Create workspace hubs based on
different criteria, such as purpose or topic, with multiple filters.

●Workspace Classification – Classify Teams, Groups, SharePointsites, and Yammer communities with personal tags.

●Cloud Governance Integration – Perform Cloud Governanceprovisioning, recertification, and lifecycle tasks without leaving Teams.

Other Application Integration●

Use the Cloud Governance admin API to obtainprogrammatic access to all Cloud Governance core services
and data or call into a Cloud Governance webhook for realtime notifications with your own or third party applications.

●The Power Automate connector enables you to automaticallytrigger actions in Cloud Governance or your own solutions toquickly and easily integrate Cloud Governance through ourconnector templates.

Information Architecture
Extensibility & Customization●

Client API – Bridge the gap between existing IT service
management systems and SharePoint Online.

●

Software Development Kit (SDK) – Create custom Policy
Enforcer rules or profiles and integrate with more than 40
different event triggers using the rules SDK.

Simplified Request
Management & Questionnaire●Service Request Setup Assistant – Help quickly set up
service requests with an approval process, renewal profile,
lifecycle configuration and policies.

●

Questionnaire – Customizable request questionnaires
gather end user information—such as roles and associatedpermission levels, as well as business requirements—to guidethem to the service form they need. A simplified service
catalog ensures the right policies are applied and users only
access services available to them.

●Request Report – A new report that provides a consolidated
view of all submitted requests and tasks. Delegate out
common administrative actions such as approve, reject,
re-assign and skip to improve operational efficiency whenmanaging requests.

Seamless Microsoft 365 User Experience●Governance Panel for Microsoft 365 Sites – Enable end
users to request resources for provisioning, permissions,
lifecycle, and content management directly within SharePoint
Online Classic Team Sites, Communication Sites, andMicrosoft 365 Group Modern Team Sites, all without signing
into AvePoint Online Services.

●Site Information Card – Display associated site
information such as site contact, lease quota, and available
services on the SharePoint Online site collection homepage.

●Policy Bar – Provide a visual indication of policies andservice levels within SharePoint Online site collections.

Yammer Integration●Embedded Yammer Feeds – Automatic creation of a
Yammer group and embedding of Yammer feed during sitecollection provisioning.

ServiceNow Integration●Using the Cloud Governance ServiceNow Integration App,end users can now use the ServiceNow platform to submit
creation requests and change requests for Microsoft 365
Teams, Groups, and Site Collections.

Enforce Organizational Policies●Policy Configuration – Define policies, metadata, approval
processes, permissions, and auditing parameters associatedwith SharePoint Online or Microsoft 365 Groups. Retroactively
apply governance policies for existing sites and site collections
to align all services with corporate governance policies.

Microsoft 365 Groups, Teams and YammerGovernance●●Request-Driven Microsoft 365 Groups Provisioning –Create Microsoft 365 Groups through a managed, selfservice process. Allow administrators to define policies for
Microsoft 365 Groups privacy, lifecycle, and membership.
Managed Provisioning of Microsoft Teams – Fully integrate
Microsoft Teams into your managed provisioning strategy byusing the "Create Microsoft Teams" service. Enable business
users to quickly provision and configure Teams with predefinedTeams templates in compliance with corporate policies. Allow
granular permission control of Private Channel creation.

●People Picker Filter – Define policies to control what users
and groups are available to search in Cloud Governancepeople pickers, allowing more granular control on what users
are available when submitting new requests and completing
renewal tasks.

●Yammer Provisioning Control – Govern the provisioning ofYammer communities through Cloud Governance in acontrolled, self-service manner. Allow administrators to apply
policies, specify membership, restrict external sharing, deploy
end of life processes, and access comprehensive workspace
reports. For Yammer communities that were created outside
Cloud Governance, use Yammer community automatic importprofile to automatically discover and manage the communities.

●

External Sharing Controls for Microsoft Teams andMicrosoft 365 Groups – Enable the appropriate level ofexternal collaboration with policy driven external sharing
controls for Microsoft Teams/Microsoft 365 Groups and theirassociated Team sites. End users can safely collaborate withexternal parties based on the use and type of information
stored their workspaces.

●Guest User Governance – Create new Azure Active
Directory guest users and specify what Microsoft Teams orGroups the guest user should be added to in a single self
service request form. Provide an automated renewal processof the guest user’s membership, contacts and metadata tocomply with security policies. Guest user reports provides
administrators a quick view into all the guest users in yourtenant. End users can see a report of invited guests they areresponsible for in the My guest users report.

●Guest User Renewal – Periodically renew or define theduration of guest users, escalate renewal jobs with an option
to remove guest user from Azure Active Directory or block
guest user from signing in to ensure compliance. Create acustom message in the guest user renewal process to help
end users understand their responsibilities when reviewing
guest user access during the renewal process.

●Guest User Import – Automatically discover and apply
governance policies to guest users in your Azure AD tenant.
Automate ongoing management of guest users by assigning a
primary contact person, capture and enforce a review process
to validate guests user access to M365 workspaces.

●Private Channel Renewal – Allow team owners, private
channel owners and team contacts to renew the ownershipand membership for each private channel during the parent
team renewal process.

• Sensitivity Label Integration – Leverage sensitivity labels
to control external sharing policies and privacy settings
services for Microsoft Teams, Groups, and SharePoint sites.
●Microsoft 365 Groups Lifecycle Management – Provide
business users with granular control over the lifecycle oftheir Microsoft 365 Groups with actions including delete,extend group lease, and change group policy.

●Primary and Secondary Group Contact – Assign primaryand secondary business users for Microsoft 365 Groups toenforce accountability and enable appropriate change
management approvals without granting elevated levels ofprivilege or native Group ownership. Enable automatedownership election if any of the owners are deactivated.

●

Recertification of Group Membership – Ensure that theMicrosoft 365 Groups members and owners remain current
and accurate with periodic recertification tasks to validate
or modify membership or ownership details.

●Automated Inactivity Tracking – Generate a Microsoft
365 Groups inactivity threshold task if the group has been
inactive for a certain amount of time, allowing automaticdeletion of the group.

●Group Naming Schemes – Allow flexible naming rules
for different types of Microsoft 365 Groups so thatorganizations can better understand their purpose andownership.

●AvePoint GroupHub Integration – Leverage the Microsoft
365 App Launcher for direct and easy access to Microsoft
365 Group provisioning, classification, and lifecycle services
from within the AvePoint GroupHub application.

Supported Service Request Types
Microsoft 365 Provisioning
●

●

●

●

●

●

●

Create Site/Site Collection – Automatically provision
policy-based SharePoint Online site collections (Classic andModern), sites, hub sites, lists, and libraries.

Dynamic Service – Create request forms with logic branching, in form validation, and context aware defaults to provide
ultimate flexibility in provisioning processes. Create easy to
submit forms that are as flexible as the provisioning requirements are complex.

Policy Enforcer Integration – Automatically apply Policy
Enforcer profiles and associated rules upon provisioning ofsites and site collections. Unauthorized changes andconfigurations in features, permissions, and settings can beautomatically adjusted back based on the preconfigured rules.
Microsoft 365 Multi-Geo Support – With Multi-Geo
support for Microsoft 365, ensure the provisioning ofworkspaces and associated content meet data residency
requirements through a managed provisioning process.

Site and Site Collection Import – Scan existing sites,
communication sites, and site collections into an Excel file,select relevant sites, and provide policy as well as site
contacts to deploy in AvePoint Cloud Governance.

Site Contact – Configure primary and secondary contacts forrelevant sites to enforce site ownership and accountability.
Hub Site Integration – Allow enabling hub sites whencreating site collections, convert existing site collection to a
hub site, or associate a site collection with a hub site.

●

●●

●

●

Central Policy Management – Centralize and reuse policy
definitions to enhance consistency across service requests forstorage management, site leases, and inactivity with flexible
policy wizard creation.
Managed Metadata Service Integration – Enforce corporate taxonomy with the ability to integrate with the Managed
Metadata Service.
Auto-URL Generation – Standardize URL formats across theSharePoint Online environment.
Temporary Permissions – Assign users with custom ortemporary permission levels during site and site collection
provisioning—automatically removing permissions on a set
expiration date.

Create Microsoft 365 Users – Allow business users to request
provisioning and de-provisioning of Microsoft365 users.

Microsoft 365 Management●Permissions Management Services – Grant, transfer, orclone custom permission assignments directly or optionallyand enforce through SharePoint group memberships.

●

Grant Permissions Level Control – Set permission level limits
for site and site collection provisioning services as well as
Grant Permissions Services to granularly enforce permissions
control.

●

Grant Permissions Services – Enable business users torequest permissions to a specified SharePoint object withapproval processes and automated assignment upon finalapproval.

●Azure Active Directory Attributes – Leverage standard andcustom Azure Active Directory (AAD) attributes as variables in
the approval process, group naming conventions, to control
access to service requests and capture additional metadata
during request or import process.

●Permissions Management Services – Give end users amanaged process to grant, change, clone, transfer, orremove user and group permissions, as well as perform
SharePoint group membership changes.

●Temporary Permissions Services – Temporarily grant users
and/or groups access to sites based on end user requests fora certain period of time before automatically expiring.

●Site Permissions Inheritance – New sites automatically use
permissions from the site or site collection in which they arecreated—including existing user groups—to proactivelyenforce existing security structures for ease of maintenanceand administration.

●Microsoft 365 Workspace Auto-Import – Automaticallyimports Microsoft 365 workspaces created outside of Cloud
Governance and identifies ownership, classification, contacts,
and policy of each workspace to balance productivity andcompliance with corporate policy.

●

Monitoring and Reporting – Generate .csv or .xls reports toprovide chargeback calculations for departments orfunctional units.

●

Dashboard – Understand KPI metrics and daily workloads
contained within AvePoint Cloud Governance with built-in
reports including Site Collection Status, Service Types ofTasks, and Task Status Distribution.

●

Power BI Template – The Power BI report template provides
access to Cloud Governance data that can be fully customized to suit different reporting needs.

●●Library Template – Ensure document libraries are createdwith the proper content types, columns, default metadata
values and more. Library templates provide a repeatable andmanageable process to script out custom deployment
settings for a document library.

Microsoft 365 Group and Sites Ownership Reports – Enduser reports provide better insight into which
Microsoft
365 Groups and Sites the user is responsible for, along withrelevant information about those group and sites, such as
custom metadata.

●Policy Enforcer Integration – Automatically apply Policy
Enforcer profiles and associated rules upon provisioning ofsites and site collections. Unauthorized changes andconfigurations in features, permissions, and settings will be
automatically adjusted back based on thepreconfigured rules.

●Terminology Management – Easily integrate within yourexisting organizational policies and processes, allowing theability to rename key roles within the application to terms
your users already know.

●

Email Template Management – Ensure a consistent user
experience across the system interface and email notifications by configuring email templates to match the end users
preferred language, as well as customize email banners,references and branding. A centralized dashboard makes it
easy to create, view and manage all the email templates inyour environment.

●

Email Notification Queue – Monitor and control end user
notifications via a report that provides administrators an
overview of upcoming emails, so they can block, delay orrelease them to users.

Microsoft 365 Lifecycle
●

●

●

●

●

●

Site Collection/Site Lifecycle Management – Services for
managing site collections and sites allow business owners
to make changes to classification and policies, extend sitelease and quota, move content, and adjust permissions.
Automated Locking and Deletion of Site Collections –Site collections that expire and are not renewed can beautomatically set to “no access” or “read-only” status, withadditional options to delete or archive after locking.
Site Lifecycle Timeline – Provides an at-a-glance dashboard view of all site governance activities since creation.
Inactivity and Lease Expiration Alerts – Notifies businessowners when their sites have not been accessed for a
specific period of time, or if the site lease is about toexpire. Reduce unnecessary storage by giving site owners
the ability to end-of-life their sites and archive as a record
on lower-tier storage.

●●Teams Lifecycle Management – Allow business users toarchive a Team with support to remove all team members,change team owners and team site permissions, andrestore a Team from an archived state. Automatic archival
is now an additional Team lifecycle action.
Multi-stage Lifecycle Management – Utilize theautomated escalation process to restrict access to Groups
or archive a Team when a lifecycle task is not completed
within a specific period of time. Choose to delete theGroup or Team after the first stage escalation has been
completed to enforce proper end-of-life management ofthe workspace.

Deactivated Owner Detection – Scheduled scans of Azure
Active Directory will detect deactivated owner accounts tokick off a new election process to designate a new owner.
Microsoft 365 User Lifecycle Management – Trigger
multiple automated Microsoft 365 user lifecycle
management actions ranging from off-boarding,extension of contract term, policy change, and unblocking.

For a comprehensive list of new features in this release, please view our AvePoint Cloud Governance Release Notes.
How to Buy AvePoint ProductsContact: 201.793.1111 | Sales@AvePoint.com
AvePoint Global Headquarters | 525 Washington Blvd, Suite 1400 | Jersey City, NJ 07310© AvePoint, Inc. All rights reserved. AvePoint and the AvePoint logo are trademarks of AvePoint, Inc. All other marks are trademarks of their respective owners.

Start your free trial today:
www.avepointonlineservices.com
Accessible content available upon request