Policies for SharePoint
AI summary
SharePoint policy templates are organized into seven categories that cover security risks, guest access, unused content, and operational issues. Each template checks a specific object type and flags violations with severity levels. Those marked Recommended are where Rencore suggests you start.
These are the policy templatesPolicyA policy is a governance rule that Rencore Governance checks against your inventory, for example Teams without owners.Read more for SharePoint, grouped by what they look for. Each template checks one kind of object and flags every item that breaks the rule. The severity shows how serious a violation is; a Recommended pill marks the templates Rencore recommends you start with.
See the SharePoint inventory reference for the objects these templates work on.
Security 7
Risky settings, weak credentials and access that is wider than it should be.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint file is shared with external users Recommended | Detects SharePoint files that have been shared externally, potentially exposing sensitive data. | High | File sharing |
| SharePoint site collection lacks sensitivity label Recommended | Detects SharePoint site collectionsSite collectionA site collection is the top-level SharePoint container that holds a root site, its subsites, lists, libraries and files.Read more missing sensitivity labelsSensitivity labelA sensitivity label is a Microsoft Purview classification, such as Confidential or Internal, that an organization applies to content and to containers such as Teams and SharePoint sites.Read more, increasing data security risks. | Medium | Site collection |
| SharePoint site has broken permission inheritance Recommended | Detects SharePoint sites where permission inheritancePermission inheritanceSharePoint sites, lists, folders and files inherit their permissions from their parent by default.Read more is broken, increasing security risks. | Medium | Site |
| SharePoint site collection is owned by external users | Identifies SharePoint site collections where external usersExternal userAn external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.Read more are in ownership roles, increasing security risks. | High | Site collection |
| SharePoint subsite has unique permissions | Detects SharePoint subsitesSubsiteA subsite is a site created under another SharePoint site in the same site collection.Read more that have unique permissions, making security management complex. | Medium | Site |
| SharePoint agent references confidential site without approval Recommended | Identifies SharePoint agents connected to confidential sites without approval, increasing the risk of unauthorized… | High | SharePoint agent |
| SharePoint agent is not approved Recommended | Identifies SharePoint agents that have not been reviewed or approved before use, posing security risks. | Low | SharePoint agent |
Guests and external access 2
Guests, external users and content shared outside your organization.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint extranet sites | Sites without MS Teams where External SharingSharing linkA sharing link is a link in SharePoint or OneDrive that grants access to a file or folder, sometimes to people outside your organization.Read more is active. | Information | Site collection |
| SharePoint file is shared with inactive external user | Highlights SharePoint files shared with external users who have been inactive for over six months. | Medium | File sharing |
Leavers 1
What people who left, or whose accounts are disabled, still own or hold.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint site collections with disabled owners accounts | Shows SharePoint site collections that have any site ownerWorkspace ownerA workspace owner is an owner of a Microsoft 365 workspace, such as a Team, a SharePoint site or a group.Read more account currently disabled. | Low | Site collection |
Clean-up 2
Inactive, empty, ownerless or outdated objects you can archive or delete.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint site collections without any owners | Shows SharePoint site collections that have no site owner. | Medium | Site collection |
| SharePoint site collection contains more than 10 agents | Detects SharePoint site collections containing more than 10 Copilot agentsCopilot Studio agentA Copilot Studio agent is an AI agent someone built in Microsoft Copilot Studio.Read more, leading to management challenges and… | Medium | Site collection |
Licenses and costs 2
Licenses, spend and storage that cost money without being used.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint site collections near storage limit | Shows SharePoint Site Collections using more than 90% of their available storage space. | High | Site collection |
| Site collection is unused with more than 1 GB Recommended | Shows sites which have not been used in last 90 days and are larger than 1 GB. | Medium | Site collection |
Agent answer quality 5
Settings that affect how reliable an agent's answers are.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint site is inactive for more than 90 days Recommended | Detects SharePoint sites without activity for a defined period, which could impact content accuracy. | Medium | Site collection |
| SharePoint agent references more than two site collections | Identifies SharePoint agents accessing data from more than two site collections, potentially leading to governance and… | Medium | SharePoint agent |
| SharePoint agent uses outdated site collection | Identifies SharePoint agents linked to site collections that have not been modified in over a year, increasing… | Medium | SharePoint agent |
| SharePoint agent uses outdated list | Detects SharePoint agents relying on lists that have not been updated in over a year, affecting AI accuracy. | Medium | SharePoint agent |
| SharePoint file is older than 5 years | Detects SharePoint files that have not been modified in over five years and may be outdated. | Information | File |
Operations 13
Day-to-day hygiene: naming, ownership, settings and configuration.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Unused classic sites Recommended | Shows classic SharePoint sitesClassic siteA classic site is a SharePoint site built on the older classic experience, with classic pages and lists instead of modern ones.Read more. | Low | Site collection |
| SharePoint libraries with disabled search | Shows SharePoint Libraries where search has been disabled. | Information | List/library |
| Sites with disabled search | Shows SharePoint Sites where search has been disabled. | Information | Site |
| Classic sites Recommended | Shows classic SharePoint sites. | Information | Site collection |
| Site collections with subsites | Shows all Site Collections that have more subsites than the root site. | Information | Site collection |
| Unused SharePoint files | Shows SharePoint files that are older than 5 years. | Information | File |
Show 7 more policies
| Policy | Description | Severity | Checks |
|---|---|---|---|
| SharePoint site collections with less than 2 site owners | Shows SharePoint site collections that have less than 2 site owners. | Medium | Site collection |
| Sites that have no hubsite configured | Shows SharePoint sites, that have not been associated with a SharePoint hub site and thus might be not easily… | Information | Site collection |
| SharePoint lists/libraries with more than 5000 items/documents | Shows SharePoint lists or libraries with more than 5000 items or documents. | Medium | List/library |
| Site collection is near subsite limit | Shows Site Collections that have nearly reached the Subsite limit of 2000 sites per Site Collection. | Low | Site collection |
| Site collection is near the list/library limit | Shows Site Collections that have nearly reached the Subsite limit of 2000 List/Library limit per Site Collection. | Low | Site collection |
| Site collections has reached the list/library limit | Shows Site Collections that have reached the Subsite limit of 2000 List/Library limit per Site Collection. | Medium | Site collection |
| Site collection has reached the subsite limit | Shows Site Collections that have reached the Subsite limit of 2000 sites per Site Collection. | Medium | Site collection |
Frequently asked questions
How many built-in policies does Rencore Governance provide for SharePoint?
How many built-in policies does Rencore Governance provide for SharePoint?32 built-in policies, such as Unused classic sites, SharePoint extranet sites and 30 more.
How are the SharePoint policies grouped?
How are the SharePoint policies grouped?By category: Security, Guests and external access, Leavers, Clean-up, Licenses and costs, Agent answer quality and Operations.
Which SharePoint policies are recommended?
Which SharePoint policies are recommended?Unused classic sites, Classic sites, SharePoint file is shared with external users and 6 more.
Which module includes the SharePoint connector?
Which module includes the SharePoint connector?The SharePoint connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.