Microsoft 365 & the executive office · For CIO
Tidy, findable and safe: document governance across OneDrive and SharePoint
- Claude
- OneDrive
- SharePoint
- Microsoft Purview
The short answer
Claude reviews documents already stored in OneDrive and SharePoint, classifies them by type and sensitivity, spots duplicates and files shared too widely, and suggests retention labels. It then produces a clean-up plan that named owners approve before anything changes. Claude only sees what each user is already allowed to see.
Key takeaways
- Most organisations hold large volumes of duplicate, stale and over-shared files that nobody owns.
- Claude classifies and checks files against your rules, then prepares a clear clean-up plan.
- Document owners approve every move, label change or sharing change before it happens.
- Permissions and Microsoft Purview settings stay in charge, so access never widens by accident.
Executive summary
Document sprawl is a quiet cost. Teams spend time hunting for the latest version, sensitive files sit open to far more people than intended, and old records linger past their legal retention period. Claude, working inside Microsoft 365, can review OneDrive and SharePoint content on a schedule. It classifies documents by type and sensitivity, finds duplicates and over-shared files, and suggests retention labels aligned to your policies. The output is a clean-up plan, not a set of silent changes. Named owners review each proposal in a simple list and approve, adjust or reject it. Your existing Microsoft Purview controls, sharing settings and access rights remain the source of truth throughout. The result is a tidier, more findable and safer estate that your IT and records teams can defend.
What is the business problem, and what does it quietly cost?
Across most growing organisations, file storage has expanded faster than anyone's ability to manage it. The same proposal exists in five folders under slightly different names. A customer contract sits in a personal OneDrive folder that is shared with a link anyone can open. A redundancy file from three years ago is still active because nobody knows whether it can be deleted.
The cost rarely appears on a single invoice. It shows up as minutes lost each day searching for the right version, as slower audits when a regulator or auditor asks for evidence, and as the quiet risk of personal data or commercially sensitive material being exposed to the wrong people. Each of these costs is real even if it is hard to total.
- Staff searching for the 'final' version of a document instead of working on it
- Audit and legal requests that take weeks because records cannot be located quickly
- Sensitive files shared through open links that nobody remembers creating
- Storage and licence costs for content that no longer has any business value
What changes when Claude reviews your document estate?
Claude works through the files your organisation already stores in OneDrive and SharePoint. It reads document titles, locations, owners, sharing settings and content to group similar files, recognise likely duplicates and identify material that appears to contain personal or confidential information. Everything it reports is a suggestion with a reason attached, so reviewers can see why a file has been flagged.
The practical change is that governance stops being a yearly project. Instead, a rolling review keeps the estate under watch. Records managers, IT and document owners spend their time deciding rather than searching, and the number of unmanaged files steadily falls.
- Duplicates grouped together with the reason they were matched
- Files shared more widely than their sensitivity suggests, flagged for review
- Retention labels proposed in line with your existing retention schedule
- A clear list of owners, so every proposal lands with someone accountable
How does Claude connect to OneDrive, SharePoint and Microsoft Purview?
Claude connects to Microsoft 365 through Microsoft's secure connection layer, called Microsoft Graph. This is the same controlled route your staff already use, and it respects Microsoft's sign-in, access rights and admin settings. Microsoft Purview, your existing information protection and records tool, supplies sensitivity labels and retention labels that Claude reads and recommends against. Claude does not create its own separate set of rules.
Because the connection is built on Microsoft's own controls, administrators can scope which sites and libraries are included, and can switch the connection off at any time. A closely related automation is Ask your company anything: a SharePoint knowledge assistant for every team.
- Connects through Microsoft Graph, using each user's existing permissions
- Reads sensitivity and retention labels already defined in Microsoft Purview
- Works within administrator-set scope for sites, libraries and folders
- Can be paused or removed by IT without affecting the underlying files
What does a day look like before and after, for a document owner?
Before, a senior programme manager spends most of a Friday afternoon searching OneDrive and SharePoint for the latest signed version of a supplier agreement, then checks whether a copy with customer data has been shared outside the company. Her list of follow-ups grows each week.
After, a weekly review arrives in her Teams activity with three items: a duplicate pair to merge, a shared folder with an open link to close, and a retention label to confirm. She approves two, edits one and is finished in under twenty minutes. The search is no longer her problem to solve.
- Weekly review lands as a short, ordered list rather than an open-ended search
- Each item explains what was found and why it matters
- Owners keep the final decision on every change
How are permissions, security and accountability protected?
Governance only works if people trust it. Claude is designed so that it sees only what each user is already allowed to see, and it never widens access. Any action that changes a file, its label or its sharing is queued for a named owner or records manager to approve. Every proposal and every decision is logged, creating an audit trail that IT and compliance teams can review.
Claude does not make legal or regulatory determinations. Retention and privacy decisions remain with your records, legal and data protection leads. The design supports the expectations your regulators already set, such as the ability to show who had access to a record and when it was changed. For background on how Anthropic handles security and compliance, see the Anthropic Trust Center.
- Claude sees only what each user is already permitted to access
- No change happens without a named owner's approval
- Every suggestion, approval and rejection is logged for audit
- Retention and privacy decisions stay with your legal and records leads
How do you measure whether document governance is working?
Measure governance by what people experience and what the estate looks like. Useful measures include the time staff spend locating documents, the number of duplicate groups open at any time, the count of files shared beyond their intended audience, and the share of documents carrying an appropriate retention label. Track these monthly so trends are visible to the CIO and the audit committee.
Teams typically see the open duplicate and over-sharing counts fall steadily over the first quarter, although the pace depends on the size and age of the estate. For wider context on how Claude fits into your Microsoft 365 estate, read how Claude and Microsoft 365 together lift productivity across the whole organisation.
- Average time to locate a current document
- Open duplicate groups and their age
- Externally shared files outside intended audiences
- Share of documents carrying appropriate retention labels
How should an organisation start?
Start with a free automation audit. We look at your current Microsoft 365 setup, where the largest concentrations of unmanaged content sit, which Purview labels already exist, and which teams feel the pain most. The audit produces a short plan showing where governance will deliver the fastest visible improvement.
The first pilot usually covers one department's OneDrive and one SharePoint site. Owners review proposals for a few weeks, rules are refined, and only then is the scope widened. This keeps trust high and ensures every change is one your people have agreed to.
- Free audit of your Microsoft 365 estate and Purview setup
- Pilot on one department and one SharePoint site
- Owner-led review for the first few weeks
- Scale-up once owners trust the proposals
How it works
Scope the estate
IT chooses which sites, libraries and folders Claude may review, using Microsoft's own administrator settings.
Classify and group
Claude sorts documents by type, likely owner and sensitivity, and groups likely duplicates with the reasons shown.
Check sharing and labels
Files shared more widely than their sensitivity suggests are flagged, and retention labels from Microsoft Purview are proposed.
Prepare the clean-up plan
Each proposal is written as a short, plain-English item with a named owner attached.
Owners approve
Document owners or records managers approve, edit or reject each item. Nothing changes until they do.
Log and learn
Every decision is recorded for audit, and the rules are refined so future proposals are more accurate.
Before and after
Finding the current version of a contract
BeforeSearching several folders and mailboxes, often taking most of an afternoon
AfterLocating the approved version quickly, with duplicates already grouped for merging
Spotting over-shared sensitive files
BeforeFound only when an incident or audit forces a search
AfterFlagged in a weekly review with a clear owner to confirm the sharing change
Applying retention labels
BeforeApplied inconsistently, often months after creation
AfterSuggested at creation or in review, and confirmed by the owner
Preparing for an audit request
BeforeSeveral weeks of manual searching and chasing owners
AfterRecords assembled from a maintained index, with the approval trail attached
What leaders typically see
- 30–50%Typical reduction in time spent searching for current documents
- WeeklyRolling review cadence replacing an annual clean-up project
- 100%Changes approved by a named owner before they take effect
Typical ranges. Your free audit sets a baseline for your own organisation.
What it means for each leader
- CIO
- A governed Microsoft 365 estate built on existing Microsoft controls, with a clear audit trail and no new hidden rule set.
- CISO
- Fewer over-shared sensitive files, and a visible record of every sharing change and who approved it.
- General Counsel
- Records that can be located and shown with their approval history when legal or regulatory requests arrive.
- COO
- Less time lost searching for documents, so operational teams spend their week on delivery.
- CFO
- Lower storage and licence waste from stale content, and fewer costly investigations into unmanaged records.
United States, United Kingdom, India and the Middle East
United States
Records and privacy expectations under state laws such as California's CCPA/CPRA, and sector rules such as HIPAA or SOX where they apply, shape how retention and access are reviewed. Claude supports these reviews by surfacing evidence for your compliance team, while decisions stay with your legal function. US hosting is available.
United Kingdom
UK GDPR and the Data Protection Act 2018 shape how personal data is stored, shared and deleted, and sector regulators such as the FCA or NHS guidance may add requirements. The design helps your data protection team see where personal data sits and who can reach it. UK hosting is available.
India
The Digital Personal Data Protection Act, 2023 sets expectations on how personal data is handled and retained, and sector regulators such as RBI, SEBI or IRDAI may apply to regulated firms. The review process gives your compliance team clear evidence to work from. India hosting is available.
Middle East
The UAE Personal Data Protection Law, Saudi Arabia's Personal Data Protection Law overseen by SDAIA, Qatar's data protection law, and free-zone rules such as DIFC and ADGM may all apply, with Arabic-language needs in some teams. Data-residency needs are assessed in the audit and the deployment region is chosen to meet them.
Safeguards built in
- Claude only sees files each user is already permitted to access
- Microsoft Purview labels and sharing settings remain the controlling rules
- No file, label or sharing change happens without a named owner's approval
- Every suggestion, approval and rejection is logged for audit
- Administrators can narrow scope or switch the connection off at any time
- Legal, records and privacy decisions stay with your own specialists
From audit to rollout
Free automation audit Weeks 1–2
We map your OneDrive and SharePoint estate, existing Purview labels and the teams carrying the most unmanaged content.
Pilot Weeks 3–8
One department and one SharePoint site are reviewed, with owners approving every proposal while rules are refined.
Scale-up Weeks 9–16
Coverage widens to further sites and departments as owners confirm the proposals are accurate and useful.
Steady-state governance From week 17
A rolling weekly review runs continuously, with monthly measures reported to the CIO and audit committee.
The Claude products behind it
Claude working with Outlook, Word, Excel, Teams and SharePoint.
Security and compliance information.
Frequently asked questions
What does it cost us to leave document sprawl unmanaged?
The cost is mostly hidden: staff time lost searching for versions, slower audit responses, storage paid for stale content and the risk of sensitive files being exposed. Most organisations find these costs grow each year, which is why a regular review is easier than an occasional clean-up project.
Can Claude see documents people are not allowed to open?
No. Claude works through Microsoft 365 using each user's existing permissions, so it only sees what that user is already allowed to access. It does not widen access or bypass administrator settings.
Where is our data stored and processed?
Deployment is set up in your own Microsoft or cloud account and hosted in the region your requirements call for, such as India, the United States, the United Kingdom or the European Union. The audit confirms the right region before any work begins.
How accurate are the duplicate and sensitivity suggestions?
Suggestions are only as good as the rules and the content, so the pilot exists to tune them. Every suggestion includes its reasoning, and owners approve or reject each one, which keeps errors from causing changes.
Will this change how our staff work day to day?
Mostly it removes work. Staff see a short weekly list of items to confirm rather than open-ended searching. Training is brief, and people keep control of their own files throughout.
Which Microsoft 365 tools and licences do we need?
The work relies on OneDrive, SharePoint and Microsoft Purview, so the audit confirms which of your current licences cover these tools and whether any additional Purview capability would help. We will tell you plainly what is already in place.
How long before we see results?
Most organisations see the first useful review within the pilot, typically within a few weeks of setup. Measurable reductions in open duplicates and over-shared files usually build over the first quarter.
Does this work for organisations outside the United States and UK?
Yes. We run the same governance approach in India, the UAE and Saudi Arabia, adjusting for local privacy laws, sector regulators and Arabic-language needs. Data-residency requirements are assessed in the audit.