Maturity Model for Microsoft 365 - Introduction


This is an open-source article with the community providing support for it. For official Microsoft content, see Microsoft 365 documentation.

Maturity Model for Microsoft 365


We often hear from people in the community that they know they aren't using Microsoft 365 capabilities as fully or as efficiently as they would like. Sometimes this can be an existential dread rather than a specific set of clear ideas about what is missing or what to do to work smarter.

Taking a holistic view of the technology and gaining an understanding of current state vs. desired state can help organizations in these important ways:

  • Understand and compare options for solving business problems
  • Focus time, energy, and resources on the right priorities
  • Identify the budget and resources needed to move ahead
  • Establish a baseline to show improvement over time

The SharePoint Maturity Model (SPMM)

SharePoint Maturity Model

Around the time SharePoint 2010 was released, Sadie Van Buren developed a powerful set of concepts embodied in the SharePoint Maturity Model (SPMM). The basic idea was to give people working with the platform ways to:

  • Understand their capabilities along multiple dimensions on a clearly defined scale
  • Decide which level they would like to achieve for each dimension and in what time frame
  • Improve their capabilities in tangible ways by progressing to the next level
  • Compare their organization to their peers based on quantified surveys

The SPMM was, of course, focused squarely on SharePoint. At the time, SharePoint was exclusively an on premises product and generally stood alone, unless you did a lot of work to change things. The principles, however, remain valid.

The tools have changed, but we still see similar levels of capability when using Document Libraries:

  • Team-centric - mostly document storage replacing shared drives
  • Cross-enterprise, leveraging fuller functionality
  • External collaboration

These three high-level distinctions are levels of capability we in the practitioner community see every day in our work. Some organizations are totally fine using SharePoint as a shared folder in the cloud, but most want to be working smarter than that. But how can they know what their path should be? And how can they get there?

Underpinnings: the Capability Maturity Model

SPMM was based on the Capability Maturity Model (CMM), which originally came out of work at Carnegie Mellon University and focused on software development. The premise was if you could measure yourself against a clear set of standards to identify where your practices and capabilities stood, you could take concrete steps to progress to the next level. The model defined a 5 point scale, representing the levels:


This is the starting level for a new or untried process. Practices may be somewhat effective, but they don’t take advantage of the power of the platform, nor do they take into account the multiple use cases which exist in even the smallest and simplest organization. Typically, they are undocumented and in a state of dynamic change, tending to be driven in an ad hoc, uncontrolled and reactive manner by users or events. This provides a chaotic or unstable environment for the processes.


Processes are documented or managed by a central group to enable (but not enforce) the preferred ways of doing them. Some processes are repeatable, possibly with consistent results. Process discipline is unlikely to be rigorous, but where it exists it may help to ensure that existing processes are maintained during times of stress. 


The process is well defined and agreed as a standard business process. There are sets of defined and documented standard processes established, signed off and subject to some degree of improvement over time. These standard processes are in place. The processes may not have been systematically or repeatedly used to the extent needed for their users to become fully competent or the process to be validated in a range of situations. This could be considered a developmental stage - with use in a wider range of conditions and user competence development the process can develop to next level of maturity.

Managed (Capable)

The process is quantitatively managed in accordance with agreed-upon metrics. Effective achievement of the process objectives can be evidenced (using metrics) across a range of operational conditions. The suitability of the process in multiple environments has been tested and the process refined and adapted. Process users have experienced the process in multiple and varied conditions and are able to demonstrate competence. The process maturity enables adaptions to particular projects without measurable losses of quality or deviations from specifications. Process Capability is established from this level.

Optimizing (Efficient)

Process management includes deliberate process optimization/improvement. The focus is on continually improving process performance through both incremental and innovative technological changes/improvements. Processes are concerned with addressing statistical common causes of process variation and changing the process (for example, to shift the mean of the process performance) to improve process performance. This would be done at the same time as maintaining the likelihood of achieving the established quantitative process-improvement objectives.

Management of the processes includes deliberate and systematic process improvement/optimization. There is focus is on continual improvement through both incremental and innovative technological changes/improvements. The Optimizing level is likely to include automation, reduction in manual tasks and associated variability, strong governance and compliance interventions as well as optimization for user interactions and productivity. 

Not every organization needs to be at the top level. NASA or Airbus have different goals, constraints, and risks to manage than a small marketing or retail organization. Not every department, team or function needs to be at the same level; Operations often needs to function with higher levels of maturity than, for example, Sales and this is reflected in their respective technology strategy and investment. As with any organizational capability, the organization should decide if the capability should be a strategic differentiator or simply a basic operational capability based on the organizational strategy. The former may require optimized and foolproof capabilities, where the latter only requires relative efficiency.

What's Next?

The goal of expanding the SPMM to the Microsoft 365 level is to help practitioners in the community think through how they can improve their capabilities or decide which capabilities matter most to them. These decisions should be based not just on the technology capabilities themselves, but driven by specific outcome objectives derived from the organizational strategy, possibly at a reasonably granular level as well as at the over-arching organization level.

Our goal is to apply the same Competencies that were the core of the original SPMM. Because Microsoft 365 is a much deeper and wider toolkit, we aim to produce a guidance document for each Competency, in a consistent format. Although these are clearly linked to M365, we have deliberately avoided detailing particular features and functions, focusing on the business needs and processes in the Competency documents. We hope to expand the document set to drill into the technologies; a ‘How to’ for achieving different levels with the tools M365 provides.

The current target is to deliver:

These will be supported by other related articles, such as:

Principal authors: