Why “our own team can handle it” is usually the most expensive way to run Microsoft 365 — and what the numbers look like when you actually add them up.
Ask most executives what their organization spends on Microsoft 365 governance and the honest answer is nothing. There is no line for it in the budget. Nobody signed a purchase order.
That answer is almost always wrong. The spending is real; it is just distributed. A few hours here from a systems administrator, an afternoon there from whoever inherited SharePoint, a scramble every time an auditor asks a question. It never registers as a cost because it never registered as a decision. It shows up instead as work that quietly displaces other work.
You do not need to understand SharePoint to recognize the symptom. Someone leaves and nobody knows who owns their sites. A document that should never have left the building turns out to carry a link that anyone can open. Teams multiply, one per project, one per client, three abandoned for every live one, until the environment you migrated into five years ago starts to resemble the file share it replaced. A client of ours put it more plainly than we would have: they did not want to end up with a second S drive that happens to live in the cloud.
Orchestry is a governance and lifecycle platform for SharePoint, Teams and OneDrive. What follows is not a product tour. It is an argument about where the money is already going, written for the person who has to approve it.
The case against doing it yourself
The first objection is always the same, and it is a reasonable one. We have an IT team. Why would we buy software to do something we already employ people to do?
There are three answers, in rising order of importance.
The work recurs. The budget treats it as a project.
Governance is not a cleanup you finish. Sharing links accumulate, sites get created every week, ownership drifts every time somebody changes roles or leaves. An environment that is tidy in March is untidy again by September, which means the labor is not a one-time cost to absorb. It is an annuity, paid every year, at a rate that rises with wages and with the size of the tenant.
Model that over three years for a 400-user organization and the manual effort alone comes to roughly $121,000. That is not a license you declined to buy, it is payroll you already committed, spent on work no customer will ever pay you for.
Your most expensive people, doing your least leveraged work
The people capable of auditing sharing across a tenant are the same people you hired to modernize applications, harden identity, and support the business. Governance work is invisible when it goes well and career-defining when it goes badly, which is precisely the profile of work that gets deferred. It does not slip because your team is careless. It slips because it is never the most urgent thing on any given Tuesday.
“Now with Workspace Review, you can’t take Orchestry out of my budget. This is the power of three or four full-time employees right here.”
Caryn Carman, Senior Solutions Engineer, Wildlife Conservation Society
Read that as directional rather than literal. The point holds either way. The alternative to automating this work is not doing it cheaply. It is doing it with salaries.
Some of it cannot be done by hand at any headcount
This is the part that usually ends the debate. Plenty of governance work is merely tedious, and a determined team can grind through it: pull the reports, chase the site owners, delete the old files. A handful of things they cannot do by hand at all, no matter how many people you give them:
- Enforce the standard at the moment of creation, so every new team and site arrives with the naming, structure, permissions and sensitivity settings you agreed on, instead of being corrected afterward by whoever happened to notice.
- Put a review in front of a site owner on a schedule and let a non-administrator answer it, without handing that person tenant-wide admin rights.
- Inventory every sharing link across SharePoint and OneDrive, risk-rate them, and remove the ones open to anyone in bulk. Today that is a PowerShell project, and writing the script is the easy half. The hard half is knowing which of several hundred settings to go looking at in the first place.
- Retire inactive workspaces on a policy, with the owner’s sign-off, rather than on a hunch or an anniversary.
Work of that size takes a small team days, and things get missed simply because nobody knew to look for them.
Microsoft says as much itself. Its own SharePoint lifecycle guidance concedes that as an environment grows, “it becomes increasingly difficult for your administrators to manually identify inactive sites, ownerless sites, or sites that no longer meet business requirements.” That is the platform vendor, in its own documentation, telling you the manual path runs out.
Delegation is the part people underestimate. In one published deployment, a global enterprise archived nearly 10,000 inactive workspaces, cut workspace sprawl by twenty-nine percent, and got a sixty-two percent response rate from the site owners it asked to review their own workspaces. That last number is the interesting one. Ask most organizations to get two-thirds of their site owners to answer a governance question by email, unprompted, and see what comes back.
What the numbers actually look like
Here is a worked example from earlier this year, prepared for a 400-user organization with about thirty workspaces and an internal labor cost of $100 an hour. The model assumes ten percent organizational growth a year, four percent wage inflation, and workspace reviews twice a year across ninety percent of the environment.
| Measure | 3 Year Projection |
|---|---|
| Cost of governing the environment manually | $121,218 |
| Cumulative savings with Orchestry | $59,552 |
| Recurring annual saving at the year-one rate | $32,325 |
| Payback period | 5.3 months |
| Workspace count over period | 30 today, 71 in three years |
The largest single line is OneDrive management, at roughly $11,067 a year, followed by provisioning at $9,016 and acting on the platform’s recommendations at $7,500. None of those are exotic categories. They are sharing-link exposure, keeping newly created workspaces consistent, and knowing which of the admin settings actually warrant attention. They are also, in our experience, the first three things an IT director raises when we walk an environment with them.
Note the workspace count. Thirty today, seventy-one in three years, on nothing more dramatic than ordinary growth. That is the sprawl the platform exists to absorb, and it is why the manual cost curve bends upward while the license cost does not.
How to read these numbers honestly
Treat them as directional rather than guaranteed. They rest on assumptions about one particular environment, and the value your organization places on recovered administrator time is a judgment only you can make. A CFO who believes reclaimed hours simply get absorbed into other work will discount them heavily. That is a defensible position, though it quietly concedes the point: the work is being done, and it is being paid for.
The comparison that survives scrutiny is narrower and more useful. Over three years, for an organization of this size, licensing and implementation together land below the projected savings, and the payback sits inside the first fiscal year. Larger environments compress it further. Monash Health, running Microsoft 365 for 30,000 users, reported clearing more than three terabytes of SharePoint storage overnight, cutting its SharePoint site count by more than half, and better than a fourfold return against the cost of the platform. Those figures are Orchestry’s, published with the customer’s participation rather than independently audited, which is worth knowing before anyone repeats them in a board pack.
The part that changed this year
For most of the last decade an executive could reasonably file governance under housekeeping. Copilot ended that.
Every AI assistant you deploy inherits your permissions model exactly as it stands. If a document is overshared, Copilot will find it and surface it, faithfully and instantly, to whoever asked. Microsoft’s own guidance for building a secure Copilot foundation tells administrators to go looking for sites and files that are, in its words, overshared, ownerless, inactive, or holding sensitive data that Copilot could surface, along with oversized audiences, broken permission inheritance and risky sharing links. Those are precisely the conditions that accumulate when governance depends on individual effort and memory, and they surface most often when people are busy or somebody leaves.
The scale of the problem is not a matter of opinion. In a June 2026 survey of 186 organizations, Gartner found that 51% named oversharing and data loss as the top barrier to a successful Copilot deployment. Not cost. Not user adoption. The data underneath was not ready.
The same survey found that 49% of organizations now use third-party tooling to manage and govern Microsoft 365, up from 40% a year earlier. Gartner formalized Microsoft 365 governance tools as a product category in May 2026, which is analyst-speak for a problem enough companies now pay to solve. The build-versus-buy question is quietly being settled in the market while it is still being debated in conference rooms.
The downside has a price attached to it. IBM’s 2026 Cost of a Data Breach study put the global average at $4.99 million and the United States average at $11.5 million. Among organizations in that study that suffered an AI-related incident, 92% lacked proper access controls around AI, and the incidents were driven by ordinary enforcement gaps rather than sophisticated attackers.
The board-level version of this is short. Your AI investment is capped by your permissions hygiene, and no amount of Copilot licensing improves it.
When you should not buy it
We would rather say this here than have you discover it later.
If you run 50 users and a dozen sites, and one person can hold the whole environment in their head, you do not need this. Native admin tooling and a disciplined habit will carry you further than a platform will.
If your content is still sitting on a file share, buy the migration first. Orchestry governs what is already in Microsoft 365. It does nothing for what has not arrived yet.
And if nobody in the organization is willing to own the governance decisions themselves, what gets archived, who approves a new team, how long a site may live without an owner, then the platform will produce excellent reports that nobody acts on. Software makes enforcement cheap. It does not write the policy for you.
A customer review on G2 puts that caveat better than any vendor would: “It is not really a ‘turn it on and everything is solved’ product. The value comes when you invest the time to design the right governance model, templates and processes.” That is correct, and it is worth reading twice before signing anything.
The question worth asking
The choice in front of most executives is not whether to govern Microsoft 365. Your auditors, your insurers, your customers and increasingly your own AI tools have settled that one already. The choice is whether to govern it by hand or by design.
By hand is slower to stand up, more expensive to sustain, wholly dependent on people who can resign, and structurally incapable of several things you have probably already promised somebody. By design is a fixed, forecastable cost that runs whether or not anyone remembers to run it.
So, the question is not whether your team could do this work, they could. The question is what you are buying with their time, and whether you would approve that purchase if it ever appeared on a line.
Want to know what governance is already costing your organization? Contact Qais Gharib to discuss how Compass365 and Orchestry can help.
Frequently Asked Questions
Notes and sources
Financial projections are drawn from an Orchestry Platform ROI Analysis prepared for a Compass365 client in September 2026, modeled on 400 licensed users, thirty workspaces and a $100 per hour internal cost basis. Orchestry states its calculations are based on customer inputs and Microsoft public benchmarks. The Monash Health results, the workspace archival figures and the customer quote are published by Orchestry rather than independently audited, and the Monash Health metrics carry “greater than” qualifiers in the original.
Copilot barrier and third-party tooling figures are from Gartner, “M365 Copilot and Agents: Assessing Impact and Value in 2026,” 9 June 2026, based on a survey of 186 organizations. Breach costs and AI access-control findings are from the IBM Cost of a Data Breach Report 2026. Microsoft’s guidance on identifying high-risk sites appears in “Configure a secure and governed data foundation for Microsoft 365 Copilot” on Microsoft Learn; the lifecycle quotation is from “Site lifecycle management” on Microsoft Learn.
