Hello again from the Maturity Model for Microsoft 365 Team!

Welcome back from the summer break. The Maturity Model for Microsoft 365 continues to evolve, and so does our community: over the summer all of our content moved from Microsoft Learn to the PnP community site at https://pnp.github.io/maturity-model. Your old Learn links still redirect, so nothing you have bookmarked is broken. Off Learn we can do more with the content, and you will see the first of that over the coming months.

If you think a colleague, other community member, or friend might be interested in the Maturity Model, please feel free to forward this newsletter to them. They can sign up to get the newsletter, too.

Next Session: Modern Compliance in Microsoft 365

🗓️ October 20, 2026 – Modern Compliance in Microsoft 365: A Maturity Model Perspective with ⭐Joanne Klein⭐

In September Nikki Chapple set out the why, the what and the who of governance, risk and compliance. In October Joanne C Klein takes the other view of the same competency: the how. Expect the data-level side of compliance in Microsoft 365, from classification and retention to records management, seen through the maturity levels. The two sessions are designed as a pair, so if you missed September the recording is below.

📎 Don’t miss the session—link to join is below.

📅Register now and join the discussion!​
🔗https://aka.ms/mm4m365/ics​

Recap of the last two sessions

Revisiting the Governance, Risk, & Compliance Competency – September 2026

Nikki Chapple co-authored the GRC competency with Simon Hudson in 2021 and came back to revisit it. Five years on, the environment it was written for has changed shape, and her proposal is to rebuild the competency around it.

Key Takeaways from the Session

⭐ Major Theme: We are moving from governing Microsoft 365 to governing the digital ecosystem

In 2021 the question was how to govern people using Microsoft 365. In 2026 it is how to govern people, information, AI, agents and decisions together, across a scope that now reaches into Copilot Studio, the Power Platform and third-party tools connected through MCP servers and skills files. Governance used to be periodic. Now it has to be continuous.

· Four connected capabilities instead of people, process and technology. Governance and accountability (an agent can never be the accountable party), risk management, obligations and compliance (the EU AI Act has been enforced since August, alongside NIS2, DORA and your own rules), and evidence and assurance. The last one is the capability organizations most often skip: you cannot plan the journey without knowing where you start.

· GRC sets the rule book. The specialist competencies operate the controls. One requirement, protecting sensitive information shared externally, lands differently in security, management of content, collaboration and AI. Deciding what counts as sensitive is a business decision, not an IT job, and the evidence flows back up.

· AI governance is not a fifth domain. Agents do not create a new governance model; they expose the need for the four capabilities that were already there. Who owns the agent, what can it access and change, how is it audited, and can you prove a year later which model and version ran and who approved it?

· Level 300 is the minimum for GRC. Unlike other competencies, where lower levels can be lived with for a while, nothing below documented processes, policies and feedback loops counts as a foundation. Given the pace of change, level 500, where the organization keeps learning and adapting, is the one worth aiming for. Score the four capabilities separately: averaging hides the gaps.

· Cost is a risk control. Token spend in Copilot Studio and Azure can double when Microsoft changes its pricing model. Set hard limits at tenant level, tiered allowances by risk and business value, alerts at thresholds, and a benchmark agreed with management before development starts. And IT has to learn to speak management about risk: fines and leaked data, not routers and backups.

Revisiting the People and Communities Competency – June 2026

​Tracy Van der Schyff closed our spring with a session that was deliberately not about technology. She last presented People and Communities four years ago, and her slide about who matters most in a community was the same slide, because that part has not changed. Everything around it has.

Key Takeaways from the Session

⭐ Major Theme: The most important part of People and Communities is you

People and Communities is the corner piece of the puzzle, not one of thirteen. It is where knowledge actually moves between people, which makes it the catalyst for every other competency. It is also the easiest one to underinvest in.

· The real blocker is time, not tooling. If people are the most important part of communities, does your organization actually give them the hours to take part in one? Community participation shows up in almost no KPIs or job descriptions. The same goes for training: the budget is usually there, the time almost never is. No platform decision fixes that.

· Most organizations are parked at level 200, and it is comfortable there. Small known circles, still fragmented, expertise still hard to find. The noise of the modern workplace makes 200 a comfortable couch to fall back onto. At 400, aim for intentional rather than consistent: intent is the proof that people understand which tool to use when.

· Community is no longer a place you go. It is what happens when people, knowledge and context come together. The challenge is not building communities but making them visible, usable and valuable in a noisy world. People made the workplace noisy long before AI arrived; AI just makes it happen faster.

· What feels forced at first becomes culture over time. Communities do not start organically. Somebody designs the skeleton, runs a content schedule and gets leaders posting, including posts they did not write themselves. Once it catches, whoever carried the schedule can step off.

· Measure value, not participation. Anchor the metric to what the organization says its strategy is, then watch behavior change: conversations moving out of inboxes and into channels. The inverse works faster with leadership: count the mass emails, the competing sources of truth and the repeats, and present it as risk and cost. And silence is data: radio silence in a crisis means the conversation is happening somewhere you cannot see.

Missed them? Don’t worry—we’ve got the recordings and slides ready for you below.

· September 2026 recording: https://www.youtube.com/watch?v=H9-QqsdxSj0​

· June 2026 recording: https://www.youtube.com/watch?v=65y6rZu89mQ​

· Slides from all sessions: https://symp.info/MM4M365Slides​

· Written summaries of every session: Practitioners Calls Archive​

MM4M365 Articles & Resources

Looking for practical guidance? Explore MM4M365 content, including:
✅ Competency models
✅ Real-world scenarios & templates
✅ How-to-elevate guides and the assessment workbook
✅ Practitioner Call invites and the calls archive

🔗 Find it all on the PnP community site: https://pnp.github.io/maturity-model/​

Still a gap after three years: the Data Analytics competency has no author. If that is your field, we would love your help. Practical scenarios are always welcome too: if you have built something in your own environment that works better than what you have seen elsewhere, write it up.

Upcoming Sessions

We meet on the third Tuesday of the month (except for summer and winter holidays). Add the full schedule to your calendar:
🔗https://aka.ms/mm4m365/ics​

🗓️ October 20, 2026 – Modern Compliance in Microsoft 365: A Maturity Model Perspective with ⭐Joanne Klein⭐

🗓️ November 17, 2026 – AI at Work: MM4M365 Edition with ⭐the MM4M365 core team⭐

🗓️ December – Winter Break

🗓️ January 2027 – back on the third Tuesday, topic to be announced

Stay Connected

We have a LinkedIn Group and an email address. The LinkedIn Group is where the questions from the sessions continue, so help us kickstart discussions and engage!

📃 Get into the Docs: https://pnp.github.io/maturity-model/​

💬 Join our LinkedIn Group: https://www.linkedin.com/groups/10065812/​

🐦 Follow us on X (Twitter): https://x.com/M365Maturity​

📺 Watch recorded sessions: https://youtube.com/playlist?list=PLR9nK3mnD-OXALeeIt1nbgBcSLj3WxyBi​
📎 Get the slides: https://symp.info/MM4M365Slides​
📧 Email us: info@mm4m365.org​

A Large Community Built by People Just Like You!

We are part of the larger Community Microsoft 365 & Power Platform Community —be sure to explore other community offerings, including:
🔹 Community Calls & Blog
🔹 Guidance & Best Practices
🔹 Samples & Solutions
🔹 SDKs & Tools

We hope to see you at our next session! 🚀

– The MM4M365 Team

Sharing Is Caring