A Microsoft 365 tenant that stays governed as fast as it grows

Class and project Teams multiply without structure

New sites appear for every class, group, and department, with no consistent naming, structure, or owner. By the time a course ends, the site is already abandoned.

Guests who keep access after the work ends

Outside collaborators, partner institutions, adjunct faculty, and past students retain access to sites long after they should. 

Sensitivity labels and data classification fall behind

Higher education handles sensitive student and research data, and labeling it consistently at creation is a constant concern. Sites provisioned without labels create compliance exposure that is hard to find and expensive to clean up.

Storage costs that arrive as a shock

In August 2024, Microsoft replaced unlimited education storage with a fixed 100TB pooled allocation across OneDrive, SharePoint, and Exchange. Old class sites, abandoned research workspaces, and version history from years of document collaboration accumulate. Every terabyte of content you are not actively managing is a cost you are paying for.

Class and project sites, created to standard.

Provisioning Templates apply naming conventions, blocked words, the correct sensitivity label, required metadata, and structure at the moment a workspace is created, with approval routing for higher-risk requests. Faculty and staff get a self-serve request that produces a governed site every time.

Native SharePoint creation has no naming enforcement, no sensitivity label requirement, and no approval workflow unless you build it yourself.

Guest access and sensitivity, under control.

Guest requests route to a responsible site owner for one-click approval. The Team Information tab surfaces membership, sharing links, and broken permissions in a single view. Workspace Review walks owners through guest access, sensitivity labels, and sharing health monthly in about 20 minutes. Oversharing detection flags sites exposing sensitive student or research content too broadly.

Reclaim storage from sites no one uses.

Delegated lifecycle workflows route archive and reassignment decisions to the site owner as one-click actions. Inactive class and project sites are retired on schedule, storage comes back, and active content stays exactly where people expect to find it, without IT chasing every owner manually.

"The visibility and reporting in Orchestry drive us to be proactive — acting on guest access and sharing risks before they become security issues."

Glenn Penfold

Associate Director of Architecture & Applications