Is “Best Practices” a myth?

I often find myself musing over this question these days. Granted, I actually do publish something called The Microsoft 365 Best Practices Checklists–but really these are more like recommendations. In fact, I recently updated them to include governance decisions around collaboration (e.g. affecting apps such as OneDrive for Business, Teams and SharePoint Online).

But is it best practice to disable anonymous links in OneDrive and SharePoint, for example? Or to restrict external chat capability in Teams? It depends–what are your goals for having a collaboration system?

The truth is that all of the answers are correct–you can make a case for any configuration you like. The only way to implement a wrong practice, is by failing to discuss the relevant options with stakeholders. Don’t get me wrong–there are a small handful of items where I have a very strong opinion, and I will advocate for those in every engagement–Multi-factor authentication for example. But that list is actually pretty short.

The only reason I publish the Best Practices guides to begin with is because it is one of the most frequently asked questions I hear from my readers: “What are the ‘best practices’ for rolling out Microsoft 365? Email, yes–but what about the other parts, too?” I heard this question so many times that I had to respond to it.

I think what people are really asking for here is some help narrowing down their field of choices. Because what Microsoft gives us is both a blessing and a curse: so many options! We have perhaps too many degrees of flexibility for some folks to digest; many different customizations could be made, but which of these really should be made? That is the question that I try to help folks answer.

And when it comes to collaboration and data governance, this is even more tricky than dealing with areas like Azure AD and Intune, which are more “binary” in nature. MFA is either on or off. You either measure Device compliance or not. These are simple binary choices that you get to make.

But things aren’t so black-and-white everywhere. Compliance labels aren’t binary. External sharing is not a binary choice, either–sometimes you need it sometimes you don’t. Sometimes convenience wins out over security for certain sites/datasets, and anonymous links are preferred. So you can’t just say this way or that way is the best practice across the board.

Nevertheless, when you have an organization that deals in sensitive or highly regulated data (e.g. PII, ePHI, etc.), it can be helpful to say, “You may want to consider taking a closer look at this option or that option.” And that’s really the “spirit” of my Best Practices guidance. It does not mean “implement every single one of these items as I describe,” but rather, “You should consider this for your environment, and discuss it with the powers that be.” And that’s the key. If you are in IT–these are not your decisions alone to make. But hopefully, the resources I provide here on ITProMentor.com can help you have the conversations you need to have with the business(es) you serve.