You have a few hundred teams in your tenant and one or two people looking after Microsoft 365. Nobody remembers who created “Project XY final” or knows if anyone still uses it. Several teams have a single owner who left the company in March.
The sprawl looks like an enterprise problem. The staffing doesn't.
Most Microsoft Teams governance advice assumes a governance committee, a Microsoft Entra ID Governance license, and someone whose full-time job is access reviews. This article assumes none of that. Here's what to configure first, what the native controls actually cover, and where a mid-sized company runs out of native options.
What Microsoft Teams governance covers
Microsoft Teams governance is the set of policies and technical controls applied to team creation, naming, membership, data handling, and deletion. In practice it answers five questions: Who can create a team, what it's called, who can join it, what data it may hold, and when it gets archived.
Every team is a Microsoft 365 Group with a SharePoint site, a shared mailbox, a Planner plan, and a OneNote notebook attached. Governing Teams means governing all of those at once. A policy that only touches the Teams client leaves the SharePoint site wide open.
Private channels and shared channels each get their own SharePoint site, with a lightweight TEAMCHANNEL template. They inherit less from the parent team than you'd expect, so scope your policies to cover them explicitly.
Four working areas cover most of it:
- Provisioning: who can create teams, and under what conditions
- Lifecycle: how teams get renewed, archived, or deleted
- Access: who gets in, including guests and external organizations
- Classification and compliance: sensitivity labels, retention policies, data loss prevention, and audit logs
Why mid-sized companies face their own specific issues
Your license tier decides your options
The native governance controls sit across several license tiers, and where the lines fall matters a lot at your size.
| Control | Where you configure it | What it needs |
| --- | --- | --- |
| Group naming policy: prefix, suffix, blocked words | Microsoft Entra admin center | Entra ID P1 held for every group member |
| Microsoft 365 Group expiration policy | Microsoft Entra admin center | Entra ID P1 or P2 held for every group member |
| Ownerless groups and teams policy | Microsoft 365 admin center, Org settings | Business Premium, E3, or E5. Entra ID P1/P2 for all notification options |
| Sensitivity labels and retention policies | Microsoft Purview portal | E3 for most, E5 for automatic labeling |
| DLP for Teams chat and channel messages | Microsoft Purview portal | E5. E3 covers only files shared through Teams |
| Conditional access for guests | Microsoft Entra admin center | Entra ID P1 |
| Access reviews and entitlement management | Microsoft Entra admin center | Entra ID Governance or Microsoft Entra Suite. Some capabilities run on Entra ID P2 |Microsoft 365 Business Premium includes Entra ID P1. If you hold that license, naming policies, expiration policies, and conditional access are all available to you, while access reviews are not.
That gap shapes the rest of the plan. Recurring ownership and membership attestation is what keeps a governance policy alive past month three. At your tier you can't get it without adding Entra ID Governance per user.
Your reporting window is shorter than your problem
The Microsoft Teams usage report in the Microsoft 365 admin center covers 7, 30, 90, or 180 days. Select a single day and the table shows up to 28 days from the current date. Data for any given day lands within 48 hours.
180 days will find you dead teams. Proving a retention decision to an auditor two years later takes more than that. Either export to CSV on a schedule, or pull the history yourself from the Microsoft Graph API.
One admin can't also be the approval queue
Restricting team creation to a security group is the most effective single control against Teams sprawl. It also makes the admin the bottleneck. Every request now lands in one inbox with no naming context and no expiry date attached.
That tension is the real mid-market problem. Decentralized creation produces sprawl, centralized creation produces a ticket queue, and with one or two admins neither one is a good solution.
Lock it down too hard and you get shadow IT instead – conversations moving to WhatsApp, which is a worse outcome than a badly named team.
The four controls to configure first
1. Restrict who can create teams
By default every licensed user can create a Microsoft 365 Group, and therefore a team. Change that first. Create a security group and add the people who should hold creation rights. Then point the tenant setting at that group with the Microsoft Graph PowerShell SDK.
Least privilege applies to creation rights too. Two or three named people plus the service desk is usually enough. Go much wider and you're back where you started.
Don't skip the inventory step. Run Connect-MicrosoftTeams, then Get-Team and Get-TeamUser, and pipe the result into Export-Csv. You need to know what you already have before you throttle what comes next.
2. Enforce a naming policy
The prefix and suffix naming policy in Microsoft Entra ID substitutes attributes into every new group name. You can use [Department], [Company], [Office], [StateOrProvince], [CountryOrRegion], and [Title]. [GroupName] has to appear exactly once. Prefix, suffix, and group name together cap at 63 characters.
The custom blocked words list holds up to 5,000 comma-separated phrases. Matching is exact and not case sensitive, with no substring search. Blocking “test” won't block “testing”, so add both.
A naming convention you can read from a list view beats a clever one. Something like PRJ-[Department]-[GroupName] gives you the type, the owning department, and the purpose in a single line.
3. Set an expiration policy
The Microsoft 365 Group expiration policy deletes groups that nobody renews. It needs Entra ID P1 or P2 licenses held for the members of every group in scope. You don't have to assign them.
Minimum lifetime is 30 days. Most mid-sized tenants land on 365. Owners get renewal emails 30 days, 15 days, and 1 day before expiration. Groups with recent activity renew themselves automatically around 35 days out, and their owners hear nothing at all.
Deleted groups sit in a soft-delete state for 30 days, and that window isn't configurable. Build your escalation path to fit inside it.
4. Turn on the ownerless groups and teams policy
Ownerless teams are the risk nobody notices until an audit. Membership stops being managed and leavers stay in. When an eDiscovery request lands, there's nobody to answer it.
The policy lives in the Microsoft 365 admin center under Settings, Org settings, Services, Microsoft 365 Groups. Every week it emails the most active members of an ownerless group and asks one of them to take ownership. You set how many members it contacts and how many weeks it keeps asking. Up to two members per group can accept, and notifications stop as soon as someone does.
You can scope it to all groups, or to a specific list of up to 50. Business Premium, E3, and E5 all cover it. All notification options need Entra ID P1 or P2.
Classification and data protection
Sensitivity labels do two jobs at once in Teams. They classify the container, and they enforce settings on it: privacy, guest access, and access from unmanaged devices.
Keep the taxonomy short. Four labels work: Public, Internal, Confidential, and Highly Confidential. Every label you add past that is a decision you push onto a user who doesn't want to make it.
Retention policies in Microsoft Purview cover Teams chat, channel messages, and the files in the backing SharePoint site. Configure chat and channel retention separately from file retention. They run on different policies, which is the kind of thing you discover after something you needed is already gone.
Data loss prevention is where the licensing bites. E3 gives you DLP for SharePoint, OneDrive, and Exchange. That covers files shared through Teams, because those files live in SharePoint. DLP that inspects the chat and channel messages themselves against sensitive information types needs E5. If you're on Business Premium or E3, plan around that rather than budgeting time for it.
Guest access without the backlog
Guest access is where mid-sized companies leak the most. The settings are all there. What's missing is somebody who owns the offboarding.
What you have natively:
- Microsoft Entra External ID B2B collaboration settings, which restrict invitations by domain allowlist or blocklist
- External access in the Teams admin center, which controls federation with other tenants domain by domain
- Guest access in the Teams admin center, which controls what a guest can do once inside a team
- Conditional access policies, which can require MFA for every guest and external user sign-in
- SharePoint external sharing settings, which set link expiration and the default link type
What you don't have natively is a recurring review that asks the team owner whether the contractor from last spring still needs access. That's an access review, and it needs Entra ID Governance.
Until you have that, the practical substitute is a quarterly export. Pull every guest with a last sign-in date, filter for 90 days of inactivity, and send each team owner their own section. It's manual, and it still removes more stale guests than a policy nobody runs.
If you'd rather it ran without you, look at External User Manager. It puts the guest request, the approval, and the expiry date in front of the team owner rather than in your inbox.
Copilot turned oversharing into a board-level question
Microsoft 365 Copilot respects your existing permissions. That's exactly the problem.
For years, bad permissions were survivable because finding anything depended on knowing where to look. An over-permissioned SharePoint site or an “Anyone” link from 2021 just sat there, unfound. Ask Copilot about salary bands now and you get an answer assembled from any file you technically have access to.
Copilot changed nothing about your permission model. It changed how far a single question travels through it.
Three checks pay for themselves before you deploy:
- Find every team set to public visibility and confirm that was intentional
- Review every SharePoint site with an active “Anyone” sharing link
- Apply sensitivity labels to the sites holding HR, finance, and legal content, because Copilot honors label-based encryption
Where the native tools run out
Native controls are built for prevention. Cleaning up what already went wrong is where they thin out, and the gaps at mid-market size are consistent:
- No request and approval workflow (without Power Automate). A naming policy shapes the name, but nobody reviews the request behind it.
- No detailed, customized, template-based provisioning. Every new team either starts empty, so structure depends on whoever created it, or based on one of Microsoft’s team templates that only cover select use cases. Native templates preset channels and apps, but they don’t include members, files or private channels, and they can’t be set as the mandatory method to create a team.
- No recurring ownership attestation without Entra ID Governance.
- No automated archiving: The expiration policy deletes rather than archives, and archiving is a manual step, one team at a time.
- No built-in metadata. You can't tag a team with a cost center, project number, or classification and report on it later.
- Reporting stops at 180 days.
None of that means you need a third-party tool. It means you should know what you're choosing to do by hand. Ten new teams a month is fine in a spreadsheet. Fifty isn't.
A rollout that fits two admins
Days 1 to 30: inventory everything with PowerShell. Restrict creation to a security group. Publish a one-page policy that says who may request a team, what it will be named, and how long it lives.
Days 31 to 60: switch on the naming policy and the expiration policy, with a 365-day lifetime. Turn on the ownerless groups policy across all groups. Publish your four sensitivity labels.
Days 61 to 90: work the ownerless queue. Archive teams with no activity in 180 days. Export your guest list and send owners their own section. If you're on E5, configure your first two DLP rules for Teams messages.
Day 91 onward: decide what you're still doing by hand, and whether that holds for another year. What tips the decision for most teams your size isn't the feature list, it's who does the work. Teams Manager moves the request, the renewal, and the archive decision to the team owner. That happens inside Teams, so those decisions stop arriving as tickets for you. To see that against your own tenant, book a free demo.
Start with the control that buys the most time
If you change one thing this quarter, restrict team creation and turn on the ownerless groups policy in the same week. The first stops the growth. The second finds the teams that already lost their owner.
Naming, labels, retention, and reviews all work better on a tenant that has stopped growing sideways. Our governance checklist walks through the settings in order if you want something to work from.
