Which Microsoft 365 governance mode fits your organisation?
Two questions. Thirty seconds. One clear recommendation.
A Microsoft 365 governance mode is the operating model an organisation chooses for managing its Teams and SharePoint workspaces - defined by two independent decisions: how much access an outside tool may hold, and when the rules are enforced. Answer both questions and we will show you which of the four modes fits - and the Valprovia deployment that matches it.
Can your organisation grant an outside governance tool permissions across your entire Microsoft 365 tenant?
Tenant-wide rights (for example Group.ReadWrite.All or Sites.FullControl.All) let a tool act on any workspace in your tenant. Some security teams, and most subsidiaries inside larger corporate groups, cannot grant them.
Do you want governance rules enforced the moment a workspace is created, or applied after the fact?
Enforcement at creation prevents problems before they happen. Enforcement after the fact keeps day-to-day work light and cleans up on a regular cycle.
Enclave
Governance without tenant-wide rights, enforced from the moment a workspace is created.
Who Enclave fits
- Regulated subsidiaries inside larger corporate groups
- Security teams that will not grant tenant-wide rights to a third party
- Any organisation that still wants structure applied at creation time
Recommended Valprovia deployment
Valprovia Governance with Workspaces Pooling. Your IT team pre-creates a pool of workspaces from your templates and security levels. Valprovia claims them on demand under delegated-only permissions - no tenant-wide write rights required.
View the Governance moduleEnforced
Central governance at scale, applied to every new workspace across the tenant.
Who Enforced fits
- Central IT teams running Microsoft 365 for the whole organisation
- No restriction on granting tenant-wide rights to trusted tools
- A preference for structure built in from the moment a workspace is created
Recommended Valprovia deployment
Valprovia Governance in its classic tenant-wide setup. Templates, security levels, approval flows and lifecycle rules apply to every new workspace across your Microsoft 365 tenant.
View the Governance moduleScoped
Security-first governance with a small footprint - no tenant-wide rights, corrections on a schedule.
Who Scoped fits
- Organisations that will not grant tenant-wide rights
- A preference for letting people work as they normally do
- A regular review cycle to catch and correct drift
Recommended Valprovia deployment
Valprovia Access Reviews on a defined set of workspaces. Regular reviews of Teams membership, SharePoint site permissions, item-level access and sharing links - all without needing broad rights across the tenant.
View the Access Reviews moduleNative
The Microsoft-default position - tenant-wide access, problems handled after they happen.
Who Native fits
- Organisations comfortable with tenant-wide access
- A preference for letting people work as they normally do
- Stepping in with Microsoft’s own tooling when problems appear
Where Valprovia fits
Valprovia Access Reviews sits on top of your existing Microsoft tooling. Instead of switching between SharePoint Advanced Management and Entra ID Governance for every review, you get one view of Teams membership, SharePoint site permissions, item-level access and sharing links.
View the Access Reviews module