1
Leadership & governance
Mandate, ownership, decision-making, roadmap and risk appetite.
Open framework · version 0.1 ·
Microsoft 365 Control Model
An open model for assessing Microsoft 365 as one business-critical chain rather than a collection of separate workloads.
2
Identity
Access, roles, privileged access, guests and application identities.
3
Devices
Endpoint management, compliance, configuration and alignment with identity controls.
4
Data
Classification, retention, protection, findability and information ownership.
5
Collaboration
Teams, SharePoint, OneDrive, lifecycle and external collaboration.
6
Platform operations
Monitoring, automation, change, incidents and vendor direction.
7
Adoption & AI
Behaviour, skills, Copilot readiness, agents and value creation.
How to use the model
Not as a checklist, but as a decision framework
The seven domains expose dependencies. A Copilot question, for example, is not limited to Adoption & AI; it also touches Identity, Data, Collaboration and Leadership & governance.
- Use the model to frame a problem broadly enough before solving it.
- Identify ownership, risks and missing decisions for each domain.
- Translate priorities into controls, a roadmap and feedback measures.
- Repeat the assessment when technology, organisation or risk appetite changes.
Apply the model in practice
On wiegerbosgraaf.nl I develop the public model. PEXOR uses the same principles as a basis for expert reviews and complex Microsoft 365 questions.