From Garage Band to Symphony Orchestra- How Microsoft 365 Governance Creates Harmony at Scale — with Heiko Brenn

Welcome everybody to EM665 podcast. The podcast where we explore the technologies, strategies and people shaping the modern Microsoft ecosystem. Microsoft 365 often being like a small garbage band. A few people collaborate, everyone knows what the other are doing and very little format coordinating this week's trial. At the organization's growth, more people join, new instruments are introduced and everyone being in different rooms. Teams are created with owners, SharePoint sites, Accumulate outdated content, guest-richain, access longer for the intern, naming conventions become inconsistent, applications overlap, nobody knows which workplace is still active and the governance of the intro that only after the environment has already become difficult to control. But those governance have to mean more restriction, approval process and bureaucracy or it provides the structure that allows people to collaborate more freely, security effectively. So my guest today is Hikoblan, Director of Product Marketing at BCC, the Business Collaboration Company, where he helps organizations bring governance, security and automation to M Microsoft 365. Hikob has more than 30 years of experience in IT. Through his career, he has worked as administrator, consult, product manager, technology evangelist. I think this gives him a really rare perspective that combines technical deepness, business requirements, product strategy and the real implementations. He is also frequently a conference speaker, podcast host, passionate drama and iPod music composer. He used lessons from dance, jamming session and orchestrates to explain why successful M665 collaborations depends on thinning the right balance between free-dimended structure. Today we will discuss governance, maturity, ownership, life cycle management, automation, power shell, security, adoption and how organization can scale Microsoft 365 without turning collaboration into carriers. Hi, cool, welcome to the M665 podcast. Hey, Mikko, thanks for having me. Looking forward to our conversation here. Yeah. Yeah, awesome. Yeah. So, I go before we talk about Microsoft 365 governance, coach you, little introduce yourself and tell us how your journey began into IT and why you choose Microsoft. Yeah, sure, sure, absolutely. So, yeah, as you mentioned in the industry for more than 30 years, so when I started things like DOS 3.3 were a thing, which rarely people know nowadays. So, I actually started with IT more like, what's more like an accident I would say. I made an apprenticeship at the bank and they were looking for someone who was taking care of IT administration and I said, well, hey, why not? I'm doing it. And this is where I started with PCs, printers. I was programming printer. It's Cape sequences for needle printers back in the day. So, okay, that's baiting myself. So, that's a long time ago. And I first can touch with Microsoft technology actually with exchange. So, exchange 5.5 was my first Microsoft product I was responsible for and I loved it. So, exchange is really something that's kind of dear to my heart, I would say. And obviously it evolved over time. And there was also the first product, funny enough, who supported PowerShell in with Exchange 2007. And yeah, as you mentioned, so I did administration. I went to, I did consulting, I did migrations from IBM infrastructures to Exchange. I became a product manager, product marketing manager. And yeah, so yeah, we're responsible for many different aspects of IT and mainly in the context of software vendors. So, so, so it be-to-be software industry. That's why I'm in for like the last more than 20 years. And it's fun. It's ever ever changing obviously and it's something that really interests me every day because new things coming up. And yeah, so now today, as you mentioned, I'm with BCC director of product marketing. Yeah, working with Microsoft 365 with governance automation. And that's that's mainly my business part. And then on the hobby side of things, music is really what I'm passionate about. And this is how we came up with the idea of talking about this in this context, right? Yeah, so the word governance, it's used constantly, but different people mean very different things by it. What do Microsoft 365 governance mean by you? So for me, governance is kind of the balance between creativity, freedom, and structure/rule. So for many people, governance sounds like very strict, you know, you have to do this and this and this and this is not allowed. And even though that might be part of it, I think the overall story of governance is get to people, the possibility to be creative, to do their work the best way possible and keep the, let's say the bureaucracy part in the background as much as possible so that it's not becoming a governance, it's not getting in the way, but it really helps people to get their work done the best way possible. Yeah, I see a lot of people use different words and I think they have a little bit problem to separate what's the difference between governance, administration, security and compliance. Can you just a little bit tell us? So from my perspective, governance also I think has to do in comparison with, for example, let's say security governance really has also to do with the processes, with the, with what people in finance, in HR, what kind of, how they work and what kind of guidelines they need to get their work done best way possible also to fulfill, obviously legal requirements. And that's, that's I think another important aspect of the whole governance process or implementations because there is obviously not a one size fits all. So rules have to apply according to the different parts of the organization. So with HR, legal, obviously, the rules have to be much more strict than maybe in sales and marketing. And so this, this is for me, this is the, let's say the governance part of things. Security is something that I see as, let's say, the underlying foundation in the sense of, you know, you need to have MFA unique, you have all the security measurements and applications and blaze and governance for me sits on top of that and is concentrating on, let's say, the people business and make it as easy as possible for the people to do their work, but still in the framework of that's, yeah, according to the rules and so based on the company guidelines. So will you say there are, I say, universal governance principles or must every organization create its own model? That's a good question. I think there are, there are some, some principle underlining, let's say, building blocks that I would say belong to governance in general, the way that they are implemented in detail, that might be different for every organization. That's what we see with our projects as well. But if you look at things like life cycle automation, things like ownership, things like reporting, templates, policies, things like that, I think this is something that belongs to governance in general. The interesting question is then how to really, yeah, feel that with life. Like as I mentioned before, like, okay, what's the right policy for teams or for for guest access for legal and HR compared to sales or development or marketing that there is, I think it's important to really make sure and make it clear that there is, in my perspective, and what we see is there is no one size fits all. So this is really where it becomes interesting to also understand the business of each and every organization to then define the right rules, the right policies, and then implement it accordingly. And that's another topic, I think a lot of companies discash is it's who should be responsible for governance? Is it the IT team, the security team, the complete team, legal, the leadership or it's across functional group, who should be from your perspective responsible? So from my perspective, I would say governance in general is a team sport. So it's really about involving all the different, I would say even everything that you mentioned is part of the process. So meaning if you have people in IT who are very passionate about it and they want to implement, you have a good reason to implement governance, but they don't have a sponsor on the sea level saying, okay, this is an important thing, we need to do that. Then, yeah, it's not going to work. So I think those roles have to be involved and they play their role. So for me it ideally starts at the top where there's obviously someone responsible and has the role to say we need on a corporate level, we need governance, we are responsible to meet internal and external requirements, rules, policies, laws, maybe ISO and EU regulations, other things like that so that on the board level, on the leadership level, there is someone responsible. Then of course it breaks down to the head of IT to the sea source, the security people, obviously, that need to be also involved and having especially when it comes to reporting a very important role. So, and then the, and that's the thing, another aspect that sometimes also is not really in the focus, like the people in the line of business, I think that as I mentioned at the beginning, I mean, I, and it's like, ideally the governance does its job somewhere in the background. So people don't really, don't really see it, they don't really realize it. But of course, then they need to be aware of it and yes, there are obviously technologies and we at PCC, we provide technology a tool to do that, but you have to have the people in place as well. So making these people aware of why this is important is something that is also really something that we try also to get across that it's not just, you know, I'm throwing a tool over the fence and say, okay, government, governance solved. So that's not how it works, right? So, so from the, from the top down to the bottom, so to speak, there needs to be there are different, different owners for different, for different parts of, of governance and the line of business people, they need to be in the, in the game as well, because we need to make sure that coming back to previously reset, okay, there's a, there's a combination between freedom, creativity and structure. So we need to make sure that we implement just the right structure so that still people can, can do their business the best way possible. And yeah, that's awesome. So that's a little bit dive into today's topic. We will take a little bit about music, making music and Microsoft 365. Where did you see an analogy here? Well, I think there are, there are actually, there are a couple of metaphors between, between music and in governance. So in music, and you mentioned at the beginning, you know, I'm, I'm creating like tunes on with Garage Band on my iPad, for example. It starts with a creative process, you know, you're, you're creating, I don't know, creating a drum beat or a chord progression or a melody or I'm finding a title that inspires to do something. And that's great, but then, so that's a creative part and you create this different, but then of course, the song has to be, has to have a structure. It starts somewhere, it has an intro, it has a verse, maybe a pre-chorus and a chorus, and an outro and whatever. So, so, because without that, you know, people will get lost, you know, they hear something and if there is no structure, they cannot follow the song, because it's, it sounds confusing and well, maybe for some people that might be okay, maybe like, like, maybe like free jazz, you know, which is very special, but still there, even there, there is, there's, I'm not a jazz expert here, but, but there is a structure because people play together, and that's the, that's the other thing. So, one thing, the first thing is you have this compilation of, you create something, and then you put it into a structure, and if you do it alone, like, when I'm doing the Garage Band, that's okay, I'm, I'm, I'm, I'm in control of everything, but if I'm playing with, with a band, then of course, I have to make sure that the drummer and the keyboard player, the singer, the guitarist, the bass player, they play in the, in the same, the same tuning, basically, they play with the same tempo, so that it all makes sense, and this is, this is like, like, in Microsoft 365 as well, right? So, if everybody is creating its own, its own teams, and they're, they're inviting guests, high-crazy, and nobody is taking care of if they're still needed, or everybody creates SharePoints just as they, as they want to, because there is no, there's no policy in place. It, it creates chaos, and that's, that's like, like, again, like, making music with, without a structure, or playing in a band where every musician might be, might be super professional, and, and super technically, in, in their, in their music, but if they don't play together, and if they don't listen to each other, then you, you get noise, right? You don't get music, and, and for me, this is something that is, there, there is, there is really some, a little cheat to between Microsoft, between Microsoft 365 governance and, and, and music, and there, there are, there are more, right? You could sing of, um, no, well, okay, I'm starting with one single musician, then maybe you have a band, and think about, um, having an orchestra with, I don't know, 17 musicians, and a choir with 100 people, and obviously you need a conductor, you need someone who is taking care of the sound and the dynamics, and, and again, also the, the rhythm and the tempo and things like that, because the more the bigger, um, this musical entity gets, like, with an orchestra, it's, it's really huge, right? It can be really huge. Then, without a conductor, it's, it's, it's bound to be, to end up in total chaos. Um, and so, and again, this is, I think another great, a lot of G, because if you have, as, let's say, you start, or in a small company, um, yeah, you might have, you have maybe a, a band leader, so to speak, who is, where you're defining your rules and the taken care of that, they are really, uh, in place, at the bigger the, the company organization gets, the more important it gets to really do, to have, have a conductor, who say, okay, this, this is, this is our, our rules, um, and with the induced rules, people can, can work and can, can, can do that job, but there are rules that people have to follow, because otherwise, again, we are, we are creating noise instead of something that, that really makes sense. Hmm. Um, yeah, it's interesting and, uh, it's often also called, orchestration governance, so it's, our cast, it's, it's a little bit in there, but I, I think, a little bit about SMEs, so, um, is this more, there are more a garbage bed or have they also, or the conductor, the definerals the all the I don't know or can they stop small and become bigger. Well, I think, that's a good question. I think this is this... well, the size of the organization, I think, is one part. The other part is, of course, is a small company that is making business in a highly regulated industry, then no matter how small or big you are, you have to follow certain rules. But from what I would say, from my experience, is that, obviously, with smaller companies, your policies might start at a... yeah, let's say like a think big start small, you're implementing your first policies, your first governance rules and as the company grows, then of course, yeah, the governance policy is growing as well. So I would say that, because there's also often a question like, okay, what... when should I start organizing, planning, designing my governance rules and then start implementing it? And I would say, but with way too long, yeah, start as soon as possible, because especially in a small company, when it starts to grow, then it becomes even more difficult to start to implement it. So I would definitely start at an early stage with some maybe more simplified rules, but have something in place already. And again, if it's a regulated industry, then of course, it's... well, it's mandatory, right? So it's not something that it's a nice to have, but it's a must have, for sure. Awesome. I think a little bit... where do you have a jam session? What do a jam session teach us about creativity and self-serve and how can we take this learning through to governance? Well, so a jam session is a good example where a group of people start to play together, and maybe the first time, right? So there's a drummer and then maybe a guitarist, a bass player joins in, maybe a singer, so it might be spontaneous. Everybody joins in. Everybody is motivated, brings its idea. Everybody starts playing. And then again, this is something that at one point, okay, you need to have some kind of structure. So let's say the typical jam session starts, what I experience is like, let's play a blues in, I don't know, in D major, because then you have a 12-bar structure. Everybody knows. So even without knowing the people who are playing the instruments, if you're saying, okay, let's play a blues in D minor, everybody knows what to do. When the the chord change appears and things like that. So that's when you start grooving, so to speak, so you the musicians play together, they groove together, then maybe someone is making a cue saying, okay, now we're changing, maybe we're changing keys or something. So even then, you need to have someone who is like a conductor saying, okay, we are an orchestrator saying, okay, now, okay, well, we're coming to the end, or maybe we're changing the tempo a little bit. So this is, I would say like the same, when you think about the adoption of Microsoft 365 and including obviously governance, it's like you're starting with implementing a couple of teams, people start using it, the adoption is excellent, people like it, then you get into the next phase where there are more teams, there are more sides, there are more groups, and still maybe nobody really knows what everybody doing, but it's still working somehow, but at some point you need to say, okay, now we need to have, again, we need to have some rules. And for the for the jam session, when you start it, it's typically like the example, let's play a blues in F major or whatever, everybody knows what to do, but if you're growing and maybe if new musicians come in, then yeah, rules start to make, start to make sense, and I would say it's like the same with the Microsoft 365. Yeah, awesome. I think a little bit, yeah, a successful band needs the structure, but it also needs room for, I say, interpretation. How can Microsoft 365 governance preserve that freedom? So this is, of course, again, a question about what kind of rules you actually need from your internal from your internal view or from the external regulations. I mean, with the build-in functionality from Microsoft 365, of course, making sure that maybe not everybody can create teams as they like or they have predefined templates for different areas in your organization is something that really starts to help to get a structure because what we see oftentimes is that especially in teams, it's, well, yeah, like a few years ago, the people, the organization just opened the floodgate, so to speak, right? So everybody was creating teams as they like with, I don't know, all kinds of, no, well, no naming conventions typically, so it's very difficult to find information and make sure and finding out which teams belong to which, which part of the organization. So these are things as a starting point that really helps to get some kind of structure with naming conventions. For example, also, and that's true for teams, it's also true for guests and also to make it very obvious that when what kind of guests again belong to which kind of project, for example, so because guests are typically something that are temporarily used, not all the time, but often it's project based so that it's, so people and IT have a chance to identify, for example, guests who are not necessary anymore because the project ended already like like three, six months ago. So these are things that I think are as an easy entry into governance policies and then of course the other thing is then really kind of enforcing it and making sure it's adopted. That's then the next important and yeah, interesting question, how to enforce this actually. Awesome. That's one thing that we have talked about the conductor and we do on the MC65 show, we use every show as a song and we use Zoom or for this. Do you think the AI can be came the conductor in a government environment? Ha, that's another interesting question. Even you mentioned just soon, it's something that's very interesting, but maybe in another context. So I think AI can help and is already helping to maybe not so much defining governance but making sure that the structure that has been defined is is really in place and it's in force and identifying anomalies, identifying where maybe things are drifting because maybe someone is for the reason finds a way to maybe get around maybe in conventions and say okay, I have another idea. I want to name my teams and then to automate that so that let's say you haven't sort of speak AI, infused governance or yeah, or conductor as you mentioned. So I think that's definitely something that helps. The analogy to Zoom is a little bit difficult because here you have not a lot of control about what's actually happening in the background. But AI definitely is something that, well if you think about agents, then of course you have you have AI in the center of governance anyway. So for the controlling part I would say yeah, having AI to be the conductor or to be the, let's say, to be the role that is sort of, sort of, sort of, sitting at the mission control and identifying where anomalies are taking place for me makes absolute sense, yes. Did you think Microsoft 365's service requirement, different musical arrangements? For example, virtual teams, SharePoint and OneDrive have their own governance rhythm? Well, I would say it depends again on the, if we keep in this picture, the part of the depends on the section of the orchestra, so to speak. So let's say there is maybe there needs to be a different rule for the string section and another policy for the horn section, for example, and another one for all the percussion. Because they have different roles, because they have different responsibilities, which kind of comes back to what I mentioned earlier like yes, it makes sense to have different rules for HR and legal because it needs to be much more strict. For example, if you invite a guest, the guest needs to sign electronically an NDA that might not be necessary at all for a marketing project with an agency or with a prospect in the sales area. So I think having this opportunity and having this flexibility, especially for bigger companies, it's I think really key for a successful governance implementation. Okay, interesting. What would be the N665 equivalent of the sound check before a concert? Okay, that's a good question. So the interesting thing is before the sound check, and that's something I think is also part of the whole story here. So to be able to really to make a sound check, the stage needs to be ready, the light needs to be ready, everything. So that kind of is the chop of the roadies. So if you're if you're if you're attending a concert, you're standing in the start of the stage and the show is going on, it's like, wow, it sounds great, it looks great. So obviously they made a sound check and everything. But before that, all the roadies to care of the stage set up the cabling, the instruments, the technical equipment, the lightning, and so on. And then so that that's really a nobody system, right? So if you are attending a concert, you see the musicians on stage, maybe sometimes you see the roadies just in the background doing something because maybe I don't know, a drum fell off the stage, they have to bring it back and whatever. So the roadies are very, very important part here. And then you have the sound check. And the sound check for me would be as when you talk about the equivalent to Microsoft 365, I would say this is where you do your test runs when you when you start implementing your your governance policies. And you say, okay, there is a test group we have from ideally from every part of the organization. We have people in the project, the project team, and we start we are starting to roll out the policies and we are starting to testing them for for a period of time, maybe two, three, four weeks, sometimes maybe a couple of months depending on again the size of the organization. So that's for me that would be the the the the sound check phase. So to speak. And during that time, of course, again, coming back to the roadies, you might say, okay, and we need to adjust something, you know, the I don't know, the lights I'm not configured correctly or maybe the monitor boxes or the in-ear sound is not correct. So you start to adjusting things so that when you go life, so to speak, when the show begins, everything hopefully is perfect. Interesting. Yeah, that's it's it's cool. And let's let's talk about one of your I think topic you are famous for. And this is the governance maturity. So what do you do in in major Microsoft 65 and variables looks like is it? Yeah, I don't know. And yeah, can you a little bit explain here? How did you see it? Yeah, you mean the different maturity levels that that we yeah, yeah, yeah. So I mean, there is that there are different while there are different maturity model or frameworks for that to to identify well, where do I stand as an organization? Yeah, am I at the very beginning or is everything already in place and I only need to measure monitor and maybe adjust? The the place that the policies that are in place. So the the initial phase is really where where we see let's say that's oftentimes when we when we go to customers and they say, okay, yes, we have, we have a problem with with team sprawl with guest users, brawl. We we have no consistent ownership in our for the objects in Microsoft 365 like shape on sites and so on. So so this is where we see this is like the initial phase that there might be some talk processes, but typically there is a high high real or high percentage of sprawl and and and and I'm going unorganized way of using Microsoft 365 and then what we do and that again doesn't have to do with the tool. It's really about the process and the concept where we say, okay, we need to we need to help you to implement your first basic policies that that needs to be in place before we take the next step. So so things get starts to get in a more managed way. So we start with with naming conventions from we're making sure that that every every guest, every team has an owner. We might already define things like, okay, are this can can we implement something where we can make sure that a team that is based on a on a on a on a project already has a best before end dates, how to speak. So that's a it's it's it's going to be archived after six months automatically. So so step by step getting rid of inconsistent ways of doing things and then if we go if we move forward, then the next level where we start to standardize as much as possible where we also so that might be against, for example, life cycle management where we have different policies in place, different templates for for the for different parts of the organizations and start also to monitor the activities so so that we are able to but the customer is able to identify there is something there's something going on like for example, you well normally there are let's say 15 new teams being created each week and all of a sudden it becomes 500. So this is where, okay, we we have a threshold reached where where somebody should take a look at that, why why that actually happens and then step by step implementing all these rules and policies on on the organizational, wide level and starting yeah to obviously to measure it into monitor it and then at this stage then it's about if that's in place then you are at the level where you say okay now okay we are we are optimizing we are optimizing we are tweaking policies that might also be then the the phase where depending again depending on your organization you know you might have new companies becoming part of the existing organization so we have to we have to implement that existing policies for new parts of the organization so that we we can really have a dynamic way of adjusting this different policies as as necessary so coming from avoiding stopping the sprawl in general make it more consistent, more controllable, measurable, monitoring and then being able to to change it as as necessary. I think when when you're the conductor and it's it's a hard job you have we have you must really good listen to all all the instruments and you must hear oh he has something something wrong and a lot of people I think the most people don't hear it they're sitting in the construct but they don't hear it when something it's a little bit wrong so what to what have you to listen on governance what's although I think warning signs here it's something yeah yeah starts to get get wrong. Yeah out of tune maybe so yeah so it's a good question it's about when do you start hearing the wrong notes because as you said maybe at the beginning nobody realizes it because maybe it's just one musician out of 80 but then if it becomes almost all of a sudden they're like like five who are starting to follow the wrong notes then there's obviously something wrong and you need to take action so this is this is what we see again take the example of this for example naming conventions where where it's important to identify the drift yeah it's almost like like it does decide state configuration where you say okay this is our rules and we need to we need to find out if somebody is not following the rules are trying to get get around it and having this alert mechanisms or maybe even having the the possibility to let's say self-healing so to speak so where as with the C where if it's detected the drift it automatically goes back to how it has to be best based on the on the on the governance policies so and to identify it and to let's say again there are different different ways so naming conventions might be one or as I as I mentioned earlier like all of a sudden okay there are much more guests being created by or our teams maybe even by a specific user so this is where really the monitoring part becomes important to identify that and to get automatically get an alert on that before it gets from just you know one wrong tone to 50 or 100 wrong wrong notes that are being played so having this kind of an early detection possibility really is important here and the the reason other that let's say the the source of this when something starts to drift can be can be yeah different things could be it could be a quantity of object that being created naming wrong naming conventions also if if you're measuring let's say the the size of your let's say SharePoint sites where all of a sudden you have a lot of data being being stored or being deleted maybe even even more interesting this is also in the context of user off-boddings sometimes a topic where where we see like okay this is the most maybe even more one critical most critical phases of a let's say of a user life cycle so what what happens in the last four or five days of an of an employee being within organization so taking care of that is is another important part here as well I would say let's let's talk about another I say yeah a little bit buzzword the Microsoft 365 governance sprawl what is exactly sprawl in governance and how how will you explain it as musician so the I would say the well the first thing that comes to mind and I think this is this is where where it started is like the team sprawl right where you have no policies in the sense of who is who is allowed to create teams again what's the naming convention what's the lifecycle management what templates to be used how to monitor everything I would say that that's still for many organizations a real a real pain point the same is true with guests I would say if I have to make a let's say a top five list so to speak of the what's the what's in the charts on top of of the what's the top of the sprawl chart the sprawl chart so to speak I would say teams is very high up there then then you have then you have guests for sure then you and you have also your your your share points sides but and then step by step you have the the other m365 objects but the top two are definitely teams and guests and the interesting thing is oftentimes you might think oh good this is this is something it's a buzzword and it's well it should be solved for a long time but the interesting thing is that still a lot of organizations struggle with it then they and even in that's the interesting part the the first week I started with PCC we went to a trade show and I had some conversations at at our booth and there was one huge organization which will remain nameless obviously they say they decided not to implement any any policies for teams okay and the read well that that's where it gets kind of well I don't know but it's it's not what I would do but they say well you know it's like answer was like yeah we we don't really care and there's a how how can you not care because this might be this might be very risky if you don't know what's happening inside inside your organization and then he said yeah okay we're we're not sharing any information with external they have they have they were assured of that but that's I would say really something that I've never heard before and after that conversation because that was really like okay good luck because yeah so for from from from my perspective these are still the main the main topics and still for for for for for me and for us in the in the organization the starting point for for many many many conversations that we have about about governance because this is where also you could say if you do it right it's like it like a low hanging fruit because if you start solving that and that also and that's maybe something we haven't really touched on but that but but what what I see here as an important topic is also that once you have these policies in place and you stop sprawl you can also start delegating this task in a secure way to the line of business people so you it's not it's not an IT it's not so let's say you still have to you have to still think you have to contact you in the background and the policies are in place everybody knows how how to play their instruments and now you can even you can even take someone who is maybe not in the in the in the in the limelight so to speak of of the orchestra to do things because the guidelines are clear and so as a conductor you don't have to care you are you you are able to care less about this things because you know yeah it's it's organized we we have we set our guardrails and then it just runs by the people who are who know how to play their instrument which would be in this case that the people in the land of business and and and your company when the BCC what role do you with this play on on on on a concert you mean we as with with our solution yeah so so I would I would say this is in general I would say the conductor for sure to to organize that but also I mentioned the role this role of the roadies which are often well you never see them but without them nothing would work so I would say this is something this is for the for the work in the background so to speak so defining the policies so the provisioning is automated the reviews are automated making sure that teams are being archived and deleted after the right period of time that then there are reviews scheduled automatically so this is this is something where where the roadie starts to build it and then you have to conductor once it's built that says okay now now we are we are ready and now we are going live and we are all get orchestrating it and we are making sure that every instrument plays the right tune with with the right with the right tempo and the right dynamics so that's I would say is the role of BCC and and and and aphematic in this case which is the name of the of the solution also oh we're a little little bit around run out of time so I have in every session a rapid fire round so okay and I give a short question and you give a short short answer so teams are outlook I have to say outload because I'm an exchange guy right if PowerShell were Microsoft Graph PowerShell governance or adoption which comes first governance self service or approval it belongs together so first self service but we need to have approval okay and policies of our principles what policies are the product of principles so again principles first and then policies okay a drum or guitar drums yeah the governance control organizations implement to to late what did you think oftentimes I would say this is one of the biggest mistakes when it comes to governance they're just waiting too long they are we do it later yeah because I mean you have to you you have the management up your neck saying okay we need to roll out teams we need to roll out one drive and and we engage and whatever and then everybody who's saying ah but wait a second we should think about governance it's like okay this is this is this this is the you know this is the person who's who's who's stepping on the break for the project but in my in my perspective I would say this makes perfect sense to to really not just think about governance before you do that but really start to implement at least the basic policies before you before you start a roll out because and we we we see this in many conversations that yes just this as you as we had talked about before this sprawl things in teams and guests and whatnot is it's real and it's because of that right because we need to roll out yeah just start press the button and then and then the damage is done yeah good governance in one sentence it's the perfect balance between freedom creativity and and structure okay awesome so yeah then my last question is if people taking one yeah one thing from this conversation what should it be I would say if we if we go back to the music scene I would say the most successful bands necessary I'm not the ones who was with the with the best individual musicians is it's the one that where they really play together to be successful and I think this is this is like the purpose of of of governance so to to come back to music playing a great song with with all the musicians make it sound great be successful and it's I think that that should be the role of of governance awesome yeah then my last question is who should I invite next and what secret question should I ask him ah who well I'm just I'm just saying the T Titu that you already interview Rafael corner no no no okay you you you should do that a secret question I don't know what question makes him nervous let let let let's let's judge it this I don't know maybe what's his favorite band I don't I don't know how well is his sleep because they they got a little sun beginning of the year so he can you can tell a little story about that I'm sure yeah then I can say I go thank you for joining me on the m65f powers and showing of that Microsoft c60 out of governance do's not have to be birchously system designed to stop people from from working the best governance operation much like the structure behind great music it traits a shagrhythm establish the clear responsibility and gives people enough freedom to contribute without alone the entry performance to yeah decent and cows my biggest takeaway from this conversation is that Microsoft c65s products are generally caused by a configuration itself it's caused by missing ownership in clear life cycle process and yeah this connected controls and mental atmosphere creation so yeah yeah can no longer a longer a pace with the organization so yeah governance must must therefore become an operational capability works plays me clear proposed and accountable owners uh external access must be reviewed in active content requires a life cycle and yeah thank you for for for staying here and for all the users all the links from high school you found on m665s and podcast website in this episode and yeah thank you for staying new and easy thank you me go was fun