Identity at the Center #330 - Mastering Group Management with Microsoft's David Johnson
Feb 10, 2025
David Johnson, Principal PM Architect at Microsoft who governs Microsoft 365, Entra, and SharePoint at scale. He talks group types and membership management. He covers guest definitions, lifecycle and reattestation. He explains labeling, data protection, and how AI like Copilot changes permissions and governance.
AI Snips
Chapters
Transcript
Episode notes
Delegate Group Creation With Guardrails
- Do let employees create Microsoft 365 groups and sites to avoid convoluted nesting and reuse mistakes.
- Require labeling, naming rules, and expiry policies on creation and enforce owners so resources are accountable and short lived.
Automate Post Creation Hygiene
- Do enforce group hygiene after creation using automated scans, notifications, and deletion if owners don't act.
- Use Azure jobs and post-provisioning checks to require second owners and remove stale groups (restorable within 30 days).
Collect Naming And Labels At Creation
- Do enforce naming conventions, block word lists, and require labels at group creation across all UI entry points (Teams, Outlook, SharePoint).
- Let people create in‑product but collect metadata upfront so automated policies can act consistently later.