Start free trial
Start free trial
How-to 5 steps 3 min read Updated 11 November 2026

How to automate Microsoft 365 governance policies

Turn written rules into policies that check Microsoft 365 on every scan, then let automations fix what they find, with a person approving where it matters.

Torsten Mandelkow Works with
How-to

What does it mean to automate Microsoft 365 governance policies?

Automating Microsoft 365 governance policies means expressing each rule as a policy that is checked on every scan, and attaching an automated response to the violations it finds. That response can notify the owner, ask for approval or fix the setting.

In short

  • Write each rule as a policy that is checked on every scan.
  • Attach a response to each policy: notify, ask for approval, or fix.
  • Automate objective rules first and keep approvals on destructive steps.
  • Keep the log of what ran, because it is your evidence.

Step by step

Five steps take you from a written rule to an automation you can trust.

  1. Write down the rules you already have

    List the governance rules your organization already states, such as every workspace needs two owners, inactive teams are archived and public teams are reviewed. Each one is a candidate policy.

  2. Turn each rule into a policy

    Define the condition that makes a workspace a violation, for example no activity for six months or fewer than two owners. Start from templates where they exist and add custom policies for the rest.

    In Rencore:

  3. Choose the response

    Decide what happens on a violation: a notification to the owner, an approval request, a built-in action such as archive, or a hand-off to a Power Automate flow, Azure Function or Logic App.

    Tip: Run new policies notify-only for one cycle. You will see what they would have touched before anything changes.

    In Rencore:

  4. Add approvals where judgement is needed

    Put an approval step before archive or delete so a named person signs off. Rejected requests leave the workspace as it is.

  5. Monitor and tune

    Watch violation counts and automation outcomes over time. Fix policies that produce noise, and keep the log as evidence that the rules were enforced.

Why manual governance does not hold

A policy document does nothing until someone checks it. With Teams, sites and groups created every day, a quarterly spreadsheet audit is out of date the day it finishes, and the same violations come back because nothing responds to them in between.

Policy-based automation closes that loop. The rule runs on every scan, a violation triggers a response, and the result is logged. People are involved where judgement is needed, not for work a rule can do.

Connectors in this How-to

Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.

Common questions about governance automation

What is policy-based automation in Microsoft 365 governance?
It means a rule is written once as a policy, checked automatically against your Teams, sites and groups on every scan, and followed by an action when something breaks it: notify the owner, start an approval, or fix the setting. You replace a manual audit with a repeatable check and a recorded response.
Which parts of governance should you automate first?
Start with rules that are objective and repetitive, such as workspaces without an owner, teams inactive for six months, or public teams that should be private. They have a clear yes or no answer and a standard response. Leave judgement calls, such as deleting content, behind an approval step until you trust the policy.
Can Power Automate on its own do this?
Power Automate is a good engine for the actions, but it does not tell you which workspaces break your rules. You still need a check that finds the violations across services, and someone has to keep the flows working. Used together, the policy finds the problem and the flow, or a built-in automation, carries out the response.
What tools support policy-based automation for Microsoft 365 governance?
Microsoft provides building blocks: Entra group expiration, Purview retention and Power Automate flows. Rencore Governance adds the policy layer across them: it ships over 100 policy templates, lets you configure custom ones, and runs automations manually, on a schedule or on every violation, handing work to Power Automate, Azure Functions or Logic Apps where you want them.
How do you keep automation from deleting something it should not?
Put a person in the loop for any destructive step. Use an approval before archive or delete, email the owner first, and start with notify-only for a cycle so you can see what a policy would touch. Review the log of what ran, and widen automation only after the results hold up.

Last updated 11 November 2026

About the author

Torsten Mandelkow

Torsten is co-founder and CAA at Rencore. During his time as a SharePoint consultant, he always tried to improve and automate the SharePoint development process, first by creating the SharePoint Software Factory (SPSF), and later by creating the SharePoint code analysis tools, today known as SPCAF. After an intermezzo for 3 years at Microsoft, he is now part of the RENCORE team and is responsible for the further technical development of all our tools.

Related

See a policy turn into an automation

We will show how a policy finds violations and how an automation with an approval step responds, in a short demo.

Request a demoGet started free
Rencore newsletter

Subscribe to our newsletter

Get the latest insights on governing Microsoft 365, Copilot and AI agents, delivered to your inbox.

Loading form