Frequently asked questions

A Workspace is a container for the settings, connected apps and users of its Environment. All data in a Workspace is stored in the same data center and storage container and cannot be separated. A Workspace supports one Microsoft 365 tenant, so different organizations should each use their own Workspace.

Each Workspace has exactly one Environment, and it uses the Workspace settings such as connected apps, users, storage accounts and Azure datacenter. An Environment connects to one Microsoft 365 tenant only. To govern several tenants, give each its own Workspace. To split one tenant by department or region, add Virtual Environments (Tenant Segmentation, included in the Enterprise Plan).

Yes. You can set up more than one Workspace, which helps if you are a consultant with access to several customer tenants.

Rencore Governance works with multiple Office 365 tenants. Each tenant connects to its own Workspace and needs its own subscription. This keeps each tenant's data, configuration and management separate.

Rencore Governance supports connectors for Anthropic (Preview, Claude Enterprise), Azure, Azure AI, Copilot, Copilot Studio, Exchange, Entra ID, Microsoft 365, OneDrive, Planner, Power Apps, Power Automate, Power BI, SharePoint, Teams and Viva Engage.

Yes. Rencore Governance can analyze multi-geo environments.

No. Rencore Governance does not currently support GCC or GCC High.

No. Rencore Governance has been tested with tenants of over 250,000 users, and it scales its infrastructure automatically. The amount of data in a tenant can affect how often the analysis data is refreshed.

You cannot currently schedule or force a scan. Rencore Governance runs scans automatically and continuously.

Connectors are scanned in the order they appear on the Inventory page. Currently that is Microsoft 365, Copilot Studio, Teams, Power Automate, Power Apps, SharePoint, OneDrive, Viva Engage, Exchange and Entra ID.

Yes. SharePoint libraries are not scanned if they are hidden or flagged as an application list, catalog, site asset library or system list, because they hold no collaborative content. File counts also leave out pictures, content types not based on Document, Site Pages, and files from non-document libraries or lists. Check results therefore do not include files from those libraries.

It is currently not possible to scan the owners of these group types, so the owner count shows 0.

Every team shows a default of 60 applications because Microsoft pre-installs these apps for all teams. Some are internal or legacy apps that do not appear in the Teams UI. The Teams API does not say whether an app is internal or installed manually, so Rencore shows all installed apps.

Archiving a team does not change the lock state of its SharePoint site collection, however the team is archived. The lock state changes only through a PowerShell script you run or an Automation action in Rencore Governance that sets the site collection to Read Only.

Microsoft creates and governs these codes but does not publish an official list. You can find out manually which template code a site used and what it means, and community-maintained lists of SharePoint Online site template IDs are available online.

From Release 7.4.2, the Related Objects quick reference on the left of the Inventory details pages is gone. The Related Objects page now splits relations into primary relations, which are pre-aggregated with a total, and other relations, which are grouped by service type and load on demand when you expand them.

Reports show data as charts and give a broad view of your environment, covering inventory, usage and trends. Policies show deviations from your rules as a data grid, highlight non-compliance, and can trigger automations. The two are typically used together.

Yes. Dashboards are fully customizable, and you can add, remove and reorder tiles.

No, automations are optional. Without them, reviewers can still complete reviews and change workspace access. Automations add post-review actions such as archiving or deleting workspaces, and they handle edge cases such as all reviewers rejecting or reviews expiring.

An automation triggered by On Policy Violation or On Schedule never runs twice a day for the same object, and each run can last at most 4 hours. There is no daily limit on runs unless you set a threshold. Runs triggered by On Policy Violation are limited by default to 20% of the items in the inventory; above that they do not run and the author gets an email. Runs that end in Error or Stopped are retried after the next scan, and manual runs can happen several times a day.

Yes. An environment in a trial can send 25 emails per day, and an environment with a subscription can send 10,000. When the limit is reached, Rencore Governance shows a message and pauses automations that contain emails until the next day.

Check whether Demo Mode is turned on. Demo Mode hides all notifications.

Start with Owners and Members, which cover the most common governance needs. Add Site Access and File Access if you need deeper visibility into SharePoint sharing permissions. Enable only what your reviewers can act on, because more steps mean more effort per review.

It depends on how quickly your organization responds and how large the review is. The default of 30 days gives reviewers plenty of time, and shorter windows create more urgency. For scheduled reviews, the duration must be shorter than the trigger interval so cycles do not overlap.

A manual review runs once when you trigger it, and its schedule disables itself when the cycle finishes. A scheduled review runs on a recurring cadence, stays enabled between cycles and starts a new cycle on each scheduled date.

No. Reviewer assignment currently supports Owners (assigned automatically) and Specified users (individual users you select). Security groups are not available.

Yes. A change to the schedule applies from the next cycle. The cycle that is already running keeps the configuration it started with.

The reviewers assigned to each workspace get an email, based on the Communication settings of the review. With Owners assignment these are the workspace owners, and with Specified users they are the users you selected.

The automation permissions a review needs depend on the scopes it includes. For example, the Owners and Members scopes need the Rencore Governance Automations permissions for Users, Groups and Teams. Other scopes need their own permissions, which the article lists in a table.

Aggregating is the first phase of a cycle. The system queries your Inventory for all workspaces that match the review scope and filters, which usually takes a few minutes depending on how many workspaces there are.

Status shows where a review is in its lifecycle: Pending, In Progress, Completed, Expired or Canceled. Decision shows what happened to the workspace: Reviewed, Archived, Deleted, Rejected, Unreviewed or a custom action. They are independent, so a Completed review can have the decision Reviewed or Archived.

Rejected means every assigned reviewer declined the review assignment, usually because they are not the right person to review that workspace. If you set up a rejection automation, it runs when the last reviewer rejects. A high rejection rate suggests checking workspace ownership or reviewer assignment.

Nothing changes. Unreviewed means no reviewer completed the review, so the workspace stays as it is. A follow-up automation for expired reviews runs for these workspaces if you configured one. Otherwise they are included in the next cycle while the schedule is still active.

If a workspace has no owner in Microsoft 365 and reviewer assignment is set to Owners, no reviewer is assigned. The object review stays Pending and eventually expires. Use Specified users for scopes where ownerless workspaces are common.

All pending and in-progress object reviews are canceled. Reviews that already completed or expired keep their decisions and changes. For manual triggers, the parent review schedule is also disabled automatically.

No. Each cycle is a one-time execution. To review the same workspaces again, enable the review schedule for manual triggers or wait for the next scheduled date for recurring triggers. A new cycle starts with fresh data.

Check the decision metrics on the cycle detail page. Healthy reviews have a high completion rate, a low Unreviewed count, and reviewers who use custom actions and make access changes instead of approving everything. The 12-month completion chart on the schedule detail page shows trends over time.

You are an owner of a workspace that is part of a scheduled access review. Your organization uses reviews to regularly check that the right people have access to the right workspaces.

Yes. On the review start page, select Reject Review and give a reason. You are then removed as a reviewer for that workspace, and any other assigned reviewers can still complete the review.

No. Several reviewers can start a review independently. The first reviewer to complete it submits the final result, and the review disappears from your Active tab if someone else finishes it first.

The review expires and moves to your History tab with the status Expired. Depending on your organization's configuration, expired reviews can trigger follow-up actions or notify your admin.

Changes are applied only when you complete the review by selecting Complete on the summary page. Until then they are queued. Go to the Summary step and complete the review to apply them.

Complete is the standard action and submits your changes without any further workspace action. Archive, Delete and other custom actions also trigger an automation that your admin configured. Which actions you see depends on your organization, so ask your IT admin if you are unsure what one does.

Yes, after a review is completed. Select the entry in your History tab to see a summary of all changes, including which people or permissions were added or removed.

No. Once you submit an approval or decline, you cannot change it in the Teams App. Contact your IT admin if a decision needs to be reversed.

It depends on how your admin set up the approval workflow. Sometimes one approval is enough, and sometimes every listed approver must act. The approval details modal shows whether the other approvers have already decided.

The approval expires, and the requester and your admin are notified. Ask your admin about your organization's policy for expired approvals.

Your organization's IT admin has to deploy and enable the Rencore Teams App. If you cannot find it in the Teams sidebar or the app catalog, ask your IT team for access.

The Rencore Teams App is currently optimized for the desktop and web versions of Microsoft Teams. Mobile support may be limited.

Your admin controls which features are enabled for your organization. If you do not see a feature such as Workspaces or Reviews, it has either not been enabled or not yet rolled out to your organization.

Your admin chooses which Microsoft 365 services appear in the Teams App. If a service tab is missing, that service is not enabled for the Teams App.

The Workspaces page lists workspaces where you are an owner or member. A workspace you were just added to can take a short while to sync. Also check that the right service tab is selected, because workspaces are grouped by service type: Teams, SharePoint, Viva Engage and Groups.

The Site Access and File Access sections show who has access to the workspace content and how. This includes external users, anonymous sharing links and organization-wide sharing. You can filter to focus on the access types that matter most to you.

Your IT admin creates and manages templates. If none fits, ask your IT team for a new template or for advice on which existing one to use.

Depending on your organization's setup, the workspace is created immediately or sent to an approver. You can follow the status on the History tab of the Requests page, or in Ongoing Requests on your Home page.

After submission, a request follows your organization's governance workflow. Contact your IT admin if you need to change or cancel it.

A user counts as licensed for Rencore Governance when the account is active, is not external, and has a license assigned, including a free license. Internal guests with a license are therefore counted, and an account that misses any of the three conditions is not. You can also get the count outside Rencore Governance with a PowerShell script or a Graph API call.

Following Microsoft, there are four types: internal members, external members, internal guests and external guests. Rencore Governance tells them apart by whether the account's home tenant is the current tenant (IsExternal) and whether the User Type is Member or Guest.

Select your Environment in the Workspace and Environment selector, then go to Settings, Environment Settings and Subscription. That page shows the subscription ID, the plan name, the renewal status and expiration, and at the bottom the number of licensed users.

Yes. Rencore Governance (SaaS) is available as a monthly subscription through the Azure Marketplace for the Professional and Premium plans, for tenants with up to 1,000 users. Direct purchases from Rencore are annual or multi-year subscriptions.

Yes. If you prefer to pay by wire transfer, contact the Rencore sales team directly.

If you do not cancel, the license renews automatically. Rencore recommends reviewing your requirements with your Customer Success Manager before renewal so the license still fits your governance needs.

Data is encrypted at rest in Azure and in transit with TLS 1.3. Only the Product Operations team at Rencore can access the cloud environments, and the encryption keys are managed in Azure Key Vault, where no single person can access them. Rencore GmbH holds ISO 27001:2022 and ISO 27017:2015 certifications, and Rencore Governance has a SOC 2 Type 2 report, available on request through trust.rencore.com.

Broadly, yes. Rencore runs a data protection program that it reviews continually to meet GDPR requirements, as set out in the Governance Terms of Service, the Privacy Policy and the Data Processing Agreement. Certifications and audit reports are available through the Rencore Trust Center.

By default, data is stored in Azure Storage Accounts in one of the available datacenters, which you choose when you create the Workspace.

Rencore keeps the collected data while you use the product, because dashboards, checks and reports need it. After your subscription ends it archives the data for 30 days, queues it for deletion for another 30 days, and deletes it for good 60 days after expiry. You can also delete everything yourself at any time with Delete workspace.

The apps installed depend on how consent was given. Rencore Governance Tenant Connect creates the initial connection and does not collect or modify data. With global consent, one Scanner app scans all inventories. With consent per service, separate apps cover M365, Entra ID, Exchange, Teams, SharePoint, OneDrive, Power Platform, Copilot and other services.

Microsoft now requires multi-factor authentication for administrator users. Make sure MFA is set up for the affected users, or adjust their MFA policies, and then give consent again. If the consenting administrator has no MFA, the permissions are revoked.