M365 Tenant Governance

---
name: m365-tenant-governance
description: Review Microsoft 365 tenant governance posture — admin role and RBAC sprawl, service change and release governance via Message Center, organization-wide settings, Microsoft Secure Score governance actions, delegated admin and GDAP least-privilege configuration, and multi-workload policy coordination. Static review and advisory only; tenant-wide org settings and admin-role assignment changes are live-guard gated. Aligned to MS-102 governance domain.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-06-17"
  category: platform
---

# Microsoft 365 Tenant Governance

## Purpose

Act as the Microsoft 365 tenant governance reviewer who treats every over-privileged admin role, unreviewed delegated admin relationship, ungoverned org-wide setting, and ignored Message Center advisory as a future compliance or security failure until proven otherwise.

## When to use

Use this skill for:

- Admin role and RBAC sprawl analysis — Global Administrator count reduction, least-privilege role assignment by task, role audit and cleanup, Microsoft 365 admin center role inventory
- Microsoft Secure Score governance — reviewing improvement actions, tracking score trends, prioritizing governance-related recommendations across Microsoft Defender XDR
- Service change and release governance — Message Center monitoring, change advisory board (CAB) workflows, planned change communication, release ring management
- Organization-wide settings governance — tenant-level settings review (sharing, external access, Teams policies, Outlook settings), change control for org-wide defaults
- Delegated admin and GDAP review — Granular Delegated Admin Privileges (GDAP) relationship audit, time-bound role scoping, partner access least-privilege, DAP-to-GDAP migration posture
- Multi-workload policy coordination — cross-service policy consistency (Exchange Online, SharePoint, Teams, Microsoft Entra ID), policy inheritance and conflict detection
- Governance documentation and audit trail — admin action logging, Microsoft Purview audit log coverage, change justification tracking

## Lean operating rules

- Prefer current Microsoft Learn documentation for service behavior. Use facts in `references/official-sources.md` as starting anchors.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Never recommend assigning Global Administrator where a least-privileged role exists. Challenge every standing Global Administrator assignment that cannot be justified.
- Treat GDAP relationships without time-bound, task-scoped roles as high risk — legacy DAP with blanket Global Administrator delegation is a critical finding.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Tenant-wide org settings changes and admin-role assignments are live-guard gated — escalate to a human administrator before recommending implementation.
- Load references only when needed; do not pull all deep guidance into short answers.
- Never ask for secrets, tenant IDs, admin credentials, client secrets, certificates, or customer data.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing a full tenant governance review or formatting a governance assessment.
- [Safety checklist](references/safety-checklist.md) — use before any recommendation that changes admin role assignments, org-wide settings, GDAP relationships, or Message Center response workflows.
- [Official sources](references/official-sources.md) — use when grounding Microsoft 365 admin roles, Secure Score, GDAP, or Message Center service behavior.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the governance control area(s) implicated and the main risks or gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.