SharePoint Chaos to Control: How to Tell if Your Company Is Set Up Correctly
- Brandon Alsup
- 3 hours ago
- 9 min read
“Are my staff using Microsoft apps to their fullest?”
This was a question that surfaced from one of our customers during an IT Roadmap meeting. Now, this was a genuine and reasonable question, but no one needs a gold medal for using every button in Microsoft 365 (sorry Steve). The real question is a bit sharper:
Is your Microsoft environment structured, secured, and used in a way that actually helps people work?
Prefer to listen?
That is the question that matters. I mean, that's not the question that matters in life, but when talking about Microsoft and business, it's a solid question.
Because in most organizations, the problem is not that Microsoft 365 is missing features. The problem is that the environment is messy, over-permissioned, inconsistently used, or poorly understood. And when that happens, SharePoint is usually where the disorder starts to show.
At Kosh, when our team evaluates whether a client is using Microsoft 365 well, we do not begin by asking whether they have embraced every app in the suite. We start with:
Is the environment secure?
Is access under control?
Are the tools being used for the right purposes?
Is shared information actually living in shared places?
Can leadership tell, with confidence, whether the system is healthy?
If the answer to those questions is fuzzy, then the business probably does not have a “usage” problem. It has a structure and governance problem.
Start with security, not aesthetics
If you want to know whether Microsoft 365 is being used properly, the first checkpoint is not what the SharePoint homepage looks like. It is whether the environment is fundamentally secure.
Kosh experts Koert Council and James Simmons both pointed to the same early signals:
licensing,
dedicated administrator accounts,
access control, and
device management hygiene.
So, according to two people who deal with Microsoft in SMB environments all the time, in the real world, good Microsoft 365 usage begins with sane security and clear control.
If MFA is not properly set up, that is a problem.
If the organization is paying for licenses that do not support the protections it actually needs, that is a problem.
If administrative access is being handled through shared accounts or everyday user accounts, that is a problem.
These are not abstract IT concerns. They shape how safe, accountable, and manageable the entire environment is.
A surprising number of organizations think of Microsoft 365 primarily as email and Office apps. But once your files, communication, collaboration, and user identities are all tied into the same environment, weak setup in one area starts to affect everything else.
SharePoint is often not broken. It is just being used the wrong way.
SharePoint gets blamed for a lot.
People say it is confusing. They say it is messy. They say nobody can find anything.
Sometimes that is fair.
But more often, SharePoint is not failing on its own. It is being asked to clean up habits that were never clearly defined in the first place.
One of the most common problems Kosh sees is this: users store important company files in OneDrive and then share them out from there, instead of placing shared business files in SharePoint where they belong.
This seems harmless at first. The file is still accessible. A link still works. Work still gets done.
But underneath, the structure is wrong.
When shared files live in personal storage, the business begins depending on individual users, individual permissions, and individual habits. The file may technically be available, but it is still anchored to the wrong owner and the wrong logic. Over time, that creates confusion, weakens collaboration, and makes the business more fragile than it needs to be.
A simple rule helps here:
OneDrive is for personal work. SharePoint is for shared company work. (we have an article breaking this down: OneDrive vs SharePoint)
That is not just a technical distinction. It is an operational one.
If leadership cannot answer where the real version of an important file lives, then the environment is not set up well enough.
If everyone has full control, nobody really has control
Another strong sign of a poor SharePoint setup is permission sprawl.
James described environments that had effectively become a free-for-all, with broad access and far too much control given to too many people. Koert raised the same concern from the standpoint of overly permissive access and loose governance.
This is one of the most common ways a decent collaboration platform becomes a liability.
Not because someone made one dramatic mistake. But because permissions accumulate a little at a time.
A folder gets opened up to make something easier.
A site gets shared more broadly “just for now.”
A group gets full control because it is faster than figuring out the right level of access.
Months later, no one is fully sure who has access, why they have it, or whether they still need it.
That is when SharePoint starts feeling chaotic.
It is also when real risk starts to build.
Well-run environments do not just ask whether people can get to the files they need. They ask a second question too:
Can we clearly explain who has access to what, and why?
If the answer is no, leadership should assume there is cleanup work to do.
The attachment habit tells you more than you think
One of the clearest signs that Microsoft 365 is not being used well is that people still send files around as attachments instead of sharing links.
This seems like a small thing, but it reveals a lot.
It usually means at least one of the following is true:
people do not trust the central file location
they are unsure where shared files belong
they are not comfortable with permissions
they have not been taught a better workflow
multiple versions already exist and no one knows which one is the master
James called this out directly. Emailing files instead of sharing links creates duplicates, version confusion, and uncertainty over which file is the real one.
This is one of those behaviors that looks normal until you step back and notice the cost.
A team can waste enormous time reviewing, editing, and approving the wrong version of a document simply because the organization never committed to a clean shared-file workflow.
A healthy Microsoft 365 environment does not eliminate email. But it does change the default behavior.
The master file should live in the right place, with the right permissions, and people should collaborate on that version.
Bad file placement creates bigger problems than people expect
Koert also pointed to another practical issue: not every file belongs in SharePoint.
Large files, unsupported file types, Outlook archives, database files, and overly heavy sync usage can all create performance or management problems.
Likewise, deeply nested folder structures can create technical friction and human confusion at the same time.
Many businesses still think in terms of “moving everything into the cloud” instead of designing how work should actually live once it gets there.
Those are not the same thing.
A business can migrate into Microsoft 365 and still carry over the same bad habits it had on an old file server:
too many folders
too many copies
no naming discipline
unclear ownership
random storage decisions
no real logic separating personal work from company work
The platform changes. The disorder survives.
That is why a SharePoint cleanup is often less about technology than about deciding how the business wants to work.
Reports help, but only if someone reads them with judgment
One of the most underused advantages in Microsoft 365 is visibility.
There are admin reports, device reports, usage data, and security indicators already available. Yet many organizations either never review them or review them too superficially to draw useful conclusions.
Koert mentioned Microsoft security score as a quick checkpoint. James added an important caution: those numbers need interpretation.
A score can be helpful. It can point toward obvious gaps. It can show where hygiene needs work.
But a score by itself does not understand the full environment.
If an organization uses third-party MFA, spam filtering, antivirus, or endpoint security, Microsoft may not give that environment full “credit” inside its own reporting. The raw score may look weaker than the business actually is.
That does not mean the reports are useless. It means they need context.
This is where experienced review matters. A useful assessment does not just repeat the dashboard. It interprets what the dashboard is saying.
Device hygiene usually reveals the truth
Another area where weak Microsoft 365 management often shows up is device sprawl.
Koert mentioned checking Intune and reviewing access patterns, including whether users are accessing from outside the country. James referenced a case where a client had hundreds of devices registered in Intune even though only a fraction were really in use.
That is more than an inventory problem.
It is a sign that the environment may not be cleaned up, reviewed, and maintained with enough discipline.
Healthy environments tend to look healthy in more than one place.
Permissions are cleaner.
Admin access is cleaner.
Device records are cleaner.
Usage patterns make more sense.
The broader point is this: Microsoft 365 health is rarely determined by one setting. It is revealed by whether the environment feels intentional or neglected.
What a healthy Microsoft 365 environment usually looks like
A well-used Microsoft 365 environment is not one where every employee is squeezing every drop of value from every app.
That is fantasy.
A well-used environment is one where the system is clear enough, secure enough, and disciplined enough to support real work without constant confusion.
Usually, that means:
MFA is enforced, especially for privileged access
admin responsibilities are handled through dedicated accounts, not shared logins
licensing supports the organization’s real operational and security needs
OneDrive is used for personal or draft work
SharePoint is used for shared company files and collaboration
Teams is not becoming a shadow file system no one understands
attachments are no longer the default way of collaborating on live documents
external sharing is intentional and governed
leaders or admins actually review reports and device hygiene with context
users understand the basic logic of where things belong and how to share them
If the only people who understand the environment are the IT team, then the environment is not really mature yet. A good Microsoft 365 setup creates clarity for the business, not just the technician.
A practical self-check for business leaders
If you are a business owner or department leader and you want a quick gut-check, start here.
Ask these questions:
Are shared business files living in SharePoint, or are people still sharing them out of personal OneDrive accounts?
Do we know who has admin access, and are those privileges separated from normal day-to-day user accounts?
Is MFA fully in place for the right accounts, or do we still have weak spots?
If I asked two different employees where a certain type of file belongs, would they give the same answer?
Are people mostly collaborating through links to shared files, or are they still emailing attachments back and forth?
Has anyone reviewed our permissions, sharing policies, and device records recently enough to trust them?
Are we interpreting Microsoft reports intelligently, or just glancing at scores without understanding the context?
If several of those answers are unclear, that is usually enough to justify a closer review.
The real issue is not whether your team is using Microsoft “to the fullest”
That phrase sounds ambitious, but it is often the wrong target.
Most organizations do not need to become power users of every Microsoft product. They need to become competent stewards of the environment they already depend on.
That means:
protecting it properly
organizing it clearly
assigning ownership responsibly
teaching staff the right habits
reviewing it often enough to keep it healthy
When those things are missing, SharePoint starts to feel confusing, Microsoft 365 starts to feel bloated, and leadership starts to wonder whether they are really getting value from the platform.
That is a reasonable concern.
But the answer is usually not to buy more tools or chase more features.
It is to make the environment make sense.
Final thought
If you are asking whether your staff are using Microsoft apps correctly, the best answer probably will not come from a feature checklist.
It will come from examining the structure underneath their work.
Are files living in the right places?
Are permissions sane?
Is admin access clean?
Is MFA in place?
Are reports being reviewed with judgment?
Is SharePoint acting like a real shared knowledge and collaboration layer, or just a prettier mess?
The good news is that most of this is fixable.
In many organizations, Microsoft 365 does not need to be replaced. It needs to be cleaned up, governed, and used with more intention.
This article draws on practical assessment insights shared by Kosh experts Koert Council and James Simmons, whose day-to-day work includes reviewing Microsoft 365 environments for security, structure, and real-world usability.
Disclaimer
The information contained in this communication is intended for limited use for informational purposes only. It is not considered professional advice, and instead, is general information that may or may not apply to specific situations. Each case is unique and should be evaluated on its own by a professional qualified to provide advice specifically intended to protect your individual situation. Kosh is not liable for improper use of this information.
Comments