Without early governance, tenants accumulate “Finance Final,” “Finance Final (2),” and orphaned personal gateways. Use ninety days to lock habits.
Days 1–30
- Naming convention for workspaces (e.g. Dept-Domain-Env) enforced in a request form — no free-typed production names.
- Least privilege: Admin count ≤ 3 per workspace; Content creators as Members/Contributors per your policy.
- Inventory personal gateways still bound to organizational datasets; schedule migrations.
Days 31–60
Introduce Deployment pipelines (Dev/Test/Prod) for certified content. Turn on sensitivity labels if M365 Purview is in play. Define what “Certified” means (steward, refresh alerts, RLS tests) and apply the Certified endorsement only when the checklist passes.
Days 61–90
Run an orphan audit: datasets with no refresh in 30 days, apps pointing at My Workspace, duplicate semantic models. Publish a tenant setting review (who can create workspaces, export data, publish to web). Governance that is only a slide deck fails this audit — fix settings in the Admin portal.