A primer on SharePoint Advanced Management
A primer on SharePoint Advanced Management
About SharePoint Advanced Management
Microsoft Syntex - SharePoint Advanced Management is a Microsoft 365 add-on that provides a suite of features that help:
- Manage and govern SharePoint and OneDrive
- Enhance Microsoft 365 secure collaboration capabilities
Comparing compliance options in Microsoft 365
SharePoint Advanced Management and Microsoft 365 compliance capabilities both provide comprehensive compliance and data governance solutions to help manage risk, protect and govern sensitive data, and respond to regulatory requirements; however, differ in scope and intended audience.
When compared to Purview or compliance capabilities in E5, SharePoint Advanced Management is intended to provide fine grain control at the specific content level such as Document Libraries or Sites – which are typically the responsibility of SharePoint/site administrators and/or site owners within an organization. The most common use case scenarios are management of content spawl, oversharing of content, and content lifecycle etc., at a granular level such as documents, document libraries, etc. Purview or compliance capabilities in Microsoft 365 differ in that their intent is meant for coarse grain control at the tenant level and fall under the scope of security and compliance admins within the organization.
SharePoint Advanced Management addresses the discrete scenarios the exist between native SharePoint controls and advanced compliance capabilities in Microsoft 365. For example:
| SharePoint management capabilities | w/o SAM | W/ SAM |
|---|---|---|
| SharePoint active sites management | X | X |
| External sharing policy | X | X |
| Restoring deleted sites | X | X |
| Sharing Settings | X | X |
| Allow access only from specific IP addresses | X | X |
| Manage user profiles | X | X |
| Restrict access from devices that aren’t compliant or joined to a domain | X | X |
| Automatically sign out users from inactive browser sessions | X | X |
| Block access from apps can’t enforce device-based restrictions | X | X |
| SharePoint data access governance (DAG) insights | X | |
| Restricted access control (RAC) policy for Sites and OneDrive | X | |
| Restricted access control (RAC) policy for OneDrive | X | |
| Block download policy for SharePoint sites and OneDrive | X | |
| Recent SharePoint admin actions | X | |
| Conditional access policy for SharePoint sites | X | |
| Secure SharePoint document libraries | X |
SharePoint Advanced Management capabilities with E3 and E5 compliance capabilities in Microsoft 365:
| SAM | E3 | E5 or E5 Compliance or E3 + Advanced Compliance |
|---|---|---|
| SharePoint data access governance (DAG) insights | X | X |
| Restricted access control (RAC) policy for Sites and OneDrive | X | X |
| Restricted access control (RAC) policy for OneDrive | X | X |
| Block download policy for SharePoint sites and OneDrive | X | X |
| Recent SharePoint admin actions | X | X |
| Conditional access policy for SharePoint sites through SPO Admin PowerShell | X (Requires AAD P1 as pre-requisite) | X (Requires AAD P1 as pre-requisite) * |
| Secure SharePoint document libraries | X |
* If you have E5 or E5 compliance, you can configure this policy through sensitivity labels too.
Who needs a license to use SharePoint Advanced Management SharePoint Advanced Management is a per-user license. To use SharePoint Advanced Management, you must have a license for each user in your organization. (It’s not required for guests.) Users must also be licensed for SharePoint K, P1, or P2 via standalone or a Microsoft 365 suite.
SharePoint Advanced Management is available for Commercial, WW Commercial Public Sector, Education, Charity, and US GCC, GCC-High, and DoD customers. To use Microsoft SharePoint Advanced Management, you must have a license for each user.
What happens if you remove SharePoint Advanced Management licenses?
If you remove all SharePoint Advanced Management licenses from your tenant at a future date (or your trial expires), users will no longer be able to generate data access governance reports, restrict OneDrive access by security group, review recent SharePoint site actions, manage site access based on security label, configure a default sensitivity label for a SharePoint document library, restrict access control for SharePoint sites or block the download of files from a SharePoint site or OneDrive.
Data access governance reports and anything SharePoint Advanced Management has previously processed will remain available.
Resources
Learn more about SharePoint Advanced Management at https://learn.microsoft.com/sharepoint/advanced-management.
Learn more about Microsoft 365 E5 Compliance at https://www.microsoft.com/security/business/compliance/e5-compliance?activetab=pivot%3aoverviewtab.