Maturity Model for Microsoft 365 - Introduction


This is an open-source article with the community providing support for it. For official Microsoft content, see Microsoft 365 documentation.

Maturity Model for Microsoft 365


We often hear from people in the community that they know they aren't using Microsoft 365 capabilities as fully or as efficiently as they would like. Sometimes this can be an existential dread rather than a specific set of clear ideas about what is missing or what to do to work smarter.

Taking a holistic view of the technology and gaining an understanding of current state vs. desired state can help organizations in these important ways:

  • Understand and compare options for solving business problems
  • Focus time, energy, and resources on the right priorities
  • Identify the budget and resources needed to move ahead
  • Establish a baseline to show improvement over time

Introduction to the Maturity Model for Microsoft 365

The SharePoint Maturity Model (SPMM)

Around the time SharePoint 2010 was released, Sadie Van Buren developed a powerful set of concepts embodied in the SharePoint Maturity Model (SPMM). The basic idea was to give people working with the platform ways to:

  • Understand their capabilities along multiple dimensions on a clearly defined scale
  • Decide which level they would like to achieve for each dimension and in what time frame
  • Improve their capabilities in tangible ways by progressing to the next level
  • Compare their organization to their peers based on quantified surveys

The SPMM was, of course, focused squarely on SharePoint. At the time, SharePoint was exclusively an on-premises product and generally stood alone, unless you did a lot of work to change things. The principles, however, remain valid.

The tools have changed, but we still see similar levels of capability when using Document Libraries:

  • Team-centric - mostly document storage replacing shared drives
  • Cross-enterprise, leveraging fuller functionality
  • External collaboration

These three high-level distinctions are levels of capability we in the practitioner community see every day in our work. Some organizations are totally fine using SharePoint as a shared folder in the cloud, but most want to be working smarter than that. But how can they know what their path should be? And how can they get there?

Underpinnings: the Capability Maturity Model

SPMM was based on the Capability Maturity Model (CMM), which originally came out of work at Carnegie Mellon University in 1986 and focused on software development. The premise was if you could measure yourself against a clear set of standards to identify where your practices and capabilities stood, you could take concrete steps to progress to the next level. The model defined a 5 point scale, representing the levels:

Level 100 - Initial

This is the starting level for a new or untried process. Practices may be somewhat effective, but they don’t take advantage of the power of the platform, nor do they take into account the multiple use cases which exist in even the smallest and simplest organization. Typically, they are undocumented and in a state of dynamic change, tending to be driven in an ad hoc, uncontrolled and reactive manner by users or events. This provides a chaotic or unstable environment for the processes.

Level 200 - Repeatable

Processes are documented or managed by a central group to enable (but not enforce) the preferred ways of doing them. Some processes are repeatable, possibly with consistent results. Process discipline is unlikely to be rigorous, but where it exists it may help to ensure that existing processes are maintained during times of stress. 

Level 300 - Defined

The process is well defined and agreed as a standard business process. There are sets of defined and documented standard processes established, signed off and subject to some degree of improvement over time. These standard processes are in place. The processes may not have been systematically or repeatedly used to the extent needed for their users to become fully competent or the process to be validated in a range of situations. This could be considered a developmental stage - with use in a wider range of conditions and user competence development the process can develop to next level of maturity.

Level 400 - Managed (Capable)

The process is quantitatively managed in accordance with agreed-upon metrics. Effective achievement of the process objectives can be evidenced (using metrics) across a range of operational conditions. The suitability of the process in multiple environments has been tested and the process refined and adapted. Process users have experienced the process in multiple and varied conditions and are able to demonstrate competence. The process maturity enables adaptions to particular projects without measurable losses of quality or deviations from specifications. Process Capability is established from this level.

Level 500 - Optimizing (Efficient)

Process management includes deliberate process optimization/improvement. The focus is on continually improving process performance through both incremental and innovative technological changes/improvements. Processes are concerned with addressing statistical common causes of process variation and changing the process (for example, to shift the mean of the process performance) to improve process performance. This would be done at the same time as maintaining the likelihood of achieving the established quantitative process-improvement objectives.

Management of the processes includes deliberate and systematic process improvement/optimization. There is focus is on continual improvement through both incremental and innovative technological changes/improvements. The Optimizing level is likely to include automation, reduction in manual tasks and associated variability, strong governance and compliance interventions as well as optimization for user interactions and productivity. 

Not every organization needs to be at the top level. NASA or Airbus have different goals, constraints, and risks to manage than a small marketing or retail organization. Not every department, team or function needs to be at the same level; Operations often needs to function with higher levels of maturity than, for example, Sales and this is reflected in their respective technology strategy and investment. As with any organizational capability, the organization should decide if the capability should be a strategic differentiator or simply a basic operational capability based on the organizational strategy. The former may require optimized and fool proof capabilities, where the latter only requires relative efficiency.

Maturity Model for Microsoft 365 summary

The Microsoft 365 platform is vast and changes rapidly, but business needs are common and slower. The Maturity Model for Microsoft 365 attempts to concentrate on defining a set of business competencies, that resonate with Microsoft 365 yet underpin real business activities. Together, the documents create a set of tools, not just information. These should allow organizations to figure out where they are in any function or department and what ‘better’ entails. Not only should the Maturity Model for Microsoft 365 not be about features, but it shouldn't be just about IT either; so we it uses common language that all sorts of business roles can understand so that everyone can use the model.

In developing a maturity model for Microsoft 365 we aimed to create a toolkit which follows a set of principles:

  • Non-partisan, i.e. informed by but not driven by today’s features in any specific platform
  • Led by business needs rather than technology features
  • Identifies key business *and- technical competencies
  • Enables organizations to evaluate the current state in a systematic and consistent way
  • Applicable to various roles in the organization

A short version of the 5 levels can be described as:

Level 500 - Optimizing (Efficient)

  • Deliberate and systematic process improvement/optimization
  • Focus is on continually improving process performance
  • Management of the processes are concerned with addressing statistical common causes of process variation and changing the process to improve process performance

Level 500 - Keywords

Optimal, systematic, statistical, improvement-focus, automated, assured, proactive

Level 400 - Managed (Capable)

  • Actively managed in accordance with agreed processes and has tracked metrics
  • Effective achievement can be evidenced across a range of operational conditions
  • Process has been tested and refined
  • Process users demonstrate competence

Level 400 - Keywords

Productive, interactive, responsive, enhanced, effective, adaptable, quality

Level 300 - Defined

  • Defined and standardized
  • Signed off, managed process
  • Limited validation of effectiveness, doesn’t include edge cases
  • Process users demonstrate familiarity

Level 300 - Keywords

Documented, policy-driven, planned, controlled, stable

Level 200 - Managed

  • Key processes defined but not standardized, uniformly or strongly applied
  • Some ability to demonstrate consistent outcomes
  • Limited buy-in from staff and management
  • Widespread inconsistency and resistance

Level 200 - Keywords

Routine, legacy, firefighting, variable, personally managed

Level 100 - Initial

  • Default, starting/exploratory state
  • People driven processes, lacking documentation and discipline
  • Many ways of doing the same thing (with variable results)
  • Characterized by inefficient legacy approaches and pockets of un-managed innovation

Level 100 - Keywords

Ad hoc, reactive, uncontrolled, chaotic, unstable

What's Next?

The goal of expanding the SPMM to the Microsoft 365 level is to help practitioners in the community think through how they can improve their capabilities or decide which capabilities matter most to them. These decisions should be based not just on the technology capabilities themselves, but driven by specific outcome objectives derived from the organizational strategy, possibly at a reasonably granular level as well as at the over-arching organization level.

Our goal is to apply the same core Competencies that were the core of the original SPMM, updated and extended to reflect the current business and technical environment. Because Microsoft 365 is a much deeper and wider toolkit, the project is creating a guidance document for each Competency, in a consistent format. Although these are clearly linked to M365, we have deliberately avoided detailing particular features and functions, focusing on the business needs and processes in the Competency documents. We will continue to expand the document set to drill into the technologies; a ‘How to’ for achieving different levels with the tools M365 provides.

The current target is to deliver:


In progress

  • Data & Analytics
  • Infrastructure



Join the Maturity Model Practitioners: Every month we host sessions exploring the value and use of the Microsoft 365 Maturity Model and how you can successfully develop your organization using Microsoft 365. Each of these sessions focus on building a community of practitioners in a safe space to hone your pitch, test your thoughts, or decide how to promote your use of the Maturity Model. Sessions may also include a brief presentation about the Maturity Model including recent updates.

Principal authors:

The MM4M365 core team has evolved over time. These are the people who have been a part of it.

Core team: