Owner-driven governance
IT defines the guardrails and policies. Site owners can continuously keep every Teams and SharePoint site compliant, without an IT-led campaign.
IT owns the Microsoft 365 tenant. It does not own the data inside it. At enterprise scale, with thousands of Teams and SharePoint sites, IT cannot safely judge whether a given owner, member, or guest still belongs. Solutions like Purview and SharePoint Admin Center do not give admins a way to delegate that responsibility to the people who have the business context to take action.
IT owns the tenant. Not the data inside it.
WeActis Security Models are templates that IT builds to ensure sites remain compliant. Those models define the permissions, folder structure, owner limits, and expiration rules for a category of Teams or SharePoint sites. When a site is created, WeActis guides the owner through a short workflow to apply the right template. From there, site owners review what they own, on a frequency that IT controls. With this feature, site owners can confirm who should keep access and who should be removed.
A site stays compliant only when three things hold true at once: a security model is applied, the lifecycle expiration date has not passed, and the access review is up to date. If one fails to comply, all other owners of that site are also notified and any of them can fix it.
Guardrails IT sets once
The gap identity governance tools do not cover
IGA (Identity Governance and Administration) platforms like Entra ID Governance handle who has access to what across your organization. What they do not cover is the Teams and SharePoint sites themselves: when a site should be archived, who still owns it, or whether the content inside it is still needed. That is exactly the layer WeActis governs.
Questions we hear a lot
What is a Security Model in WeActis?
A Security Model is a reusable template created by IT that defines permissions, folder structure, owner limits, expiration rules, and access review frequency. IT builds it once; WeActis then prompts resource owners to apply it to their Teams or SharePoint sites.
What keeps a Microsoft 365 resource compliant with WeActis?
Three conditions must be met: a security model must be applied, the expiration date must not have passed, and the access review must be current. If any one fails, all owners are notified and any of them can fix it, without involving IT.
Does IT lose control when using WeActis?
No. IT defines the guardrails once and retains full visibility through reporting across every item. Owners keep their own Teams and SharePoint sites compliant within those guardrails. Managers can see whether their direct reports have completed required reviews.
How is WeActis different from identity governance tools like Microsoft Entra?
Entra Identity Governance handles structured identity data well, but not what happens to Teams and SharePoint sites over time - when they expire, whether they should be archived, or who actually owns them. WeActis governs the unstructured M365 content the business creates ad hoc, which typically falls outside the scope of identity governance.
What is owner-driven governance, and why does WeActis use this model?
Owner-driven governance means the people closest to the content (the employees who created a Team or SharePoint site) are the ones responsible for keeping it compliant. WeActis uses this model because IT does not have the business context to decide what is still relevant. Only the owner does.
What happens when a WeActis access review is overdue?
When a review deadline passes, WeActis flags the Teams or SharePoint site as non-compliant and notifies all owners. Any owner can complete the review to restore compliant status. Admins see the full list of overdue items in the WeActis dashboard.
Can WeActis governance work alongside Microsoft Purview compliance policies?
Remove the question
See everything WeActis can do
See owner-driven governance for yourself.
See how easy it is for a data owner to take action inside Microsoft Teams, no new platform to learn.