|
If you want to keep winning defence work, you have to show the government that your systems protect its information. That is what the Cybersecurity Maturity Model Certification (CMMC) checks: 110 requirements, and proof you meet each one. Microsoft 365 in a government cloud covers a good share of the technical ones. The requirements that catch contractors out are quieter, and they are about records. Can you show that everyone read the current security policy? That the person who left in March lost access the same week? That a supplier wiped the drive before taking a machine away for repair? Those answers sit in a spreadsheet, an inbox, or nobody’s head at all. Which CMMC requirements do your business systems have to meet?Seven requirements put direct demands on the systems your teams use every day. Each one is covered in full below, with the rule it comes from, the reason it fails, and the evidence an assessor asks for.
Every product listed runs inside your own Microsoft 365 tenant rather than on external infrastructure, so the records it produces sit inside the boundary you already protect. SP Marketplace has built these applications on SharePoint, Teams and the Power Platform across more than 1,500 deployments, including government and public sector organisations. Does CMMC still matter after the 2026 suspension?Yes. The suspension paused the checking, not the standard. In July 2026 the Department of War (DoW) suspended Phase 2, which would have required third-party certification for contracts involving Controlled Unclassified Information (CUI) from November 2026. Phases 3 and 4 were frozen alongside it, and a reform task force is now reviewing the programme. Phase 1 continues unchanged: self-assessments, DFARS 252.204-7012, NIST SP 800-171, your score in the Supplier Performance Risk System (SPRS) and your annual affirmation. The programme rule was never repealed. Three things hold regardless of what the review concludes.
The records described below are what you need whichever shape the programme takes.  A padlock on laptop keyboard 1. How do you keep CUI inside your assessment boundary?You keep it in systems you already own, and the CRM is where that argument is usually lost. CUI rarely arrives on the day you win a contract. It turns up during the bid, attached to opportunities as statements of work, drawings and export-controlled specifications. Business development files them wherever the CRM tells them to. If that CRM is a commercial SaaS platform, the data has left your tenant. The vendor behind it becomes an external service provider you have to assess, document and defend. What evidence does an assessor ask for?Your boundary diagram showing where CUI enters the organisation and where it comes to rest, plus your list of external service providers and the reasoning behind each one. SP CRM Core keeps opportunities, contacts, correspondence and attachments in SharePoint inside your own tenant. In GCC High they inherit that tenant’s boundary, so the CRM never becomes a separate system you have to explain. Maps to: NIST SP 800-171 Rev 2 §3.1.3; external service providers under 32 CFR 170.19 2. How do you prove staff read the current security policy?With a timestamped acknowledgement against a named user and a specific version. Nothing less counts. Writing the policy is the easy part. Proving that four hundred people read the version in force today, rather than the one from two years ago, is what fails. New starters make it harder, and every mid-year revision resets the question. What evidence does an assessor ask for?The approved policy set with evidence of a review cycle, and acknowledgement records naming the user, the version they saw and the date. SP Policy Manager runs drafting, review, approval, publication and version history in SharePoint, then records electronic acknowledgement against each named user. Power BI dashboards show who is still outstanding, so gaps surface before an assessor finds them. One requirement to watch: your System Security Plan (SSP) sits in a small group that can never be deferred to a remediation plan. Without a current one, the assessment does not start. Maps to: §3.2.1, §3.2.2, §3.12.4 3. How do you stop access surviving after someone leaves?You put HR and IT on the same record, so nothing depends on one team remembering to tell the other. Someone hands in their notice. HR processes the leaver and IT disables the account. In most organisations those are two separate lists kept by two separate teams, and the space between them is where access quietly survives. Internal moves are worse, because nobody thinks to take anything away. What evidence does an assessor ask for?Leaver records showing when access was removed against the termination date, and evidence that screening happened before access was granted in the first place. SP Employee Hub handles this as one tracked record per person. Task templates assign work across HR, IT and facilities, covering account setup, equipment and access passes, and the same structure runs for terminations and transfers. It tracks the tasks rather than deprovisioning accounts itself, so the audit trail sits alongside Microsoft Entra ID and whatever else does the technical work. Maps to: §3.9.1, §3.9.2, §3.1.1, §3.1.2 4. How do you report a cyber incident within 72 hours?You start the clock at the helpdesk ticket, because that is where the first sign always appears. Nobody reports a security incident. They report that a file looks wrong, or that a login prompt appeared twice. That ticket is your timeline, whether you planned it that way or not. The clock runs 72 hours from discovery to reporting through DIBNet, so you have to show when discovery happened and that the report moved quickly afterwards. A timeline reconstructed weeks later is exactly what an assessor pushes back on. What evidence does an assessor ask for?Incident records with detection and response times, the escalation path that was followed, and evidence of how the reporting decision was reached. SP IT Helpdesk gives staff one obvious place to raise something and routes it automatically, so a report reaches the right person instead of sitting in an inbox. Priority handling puts an owner and a deadline against it, and every step is timestamped inside your tenant. It is not your detection stack, which sits in Microsoft Defender and Purview. It is where the human report lands and where the clock becomes auditable. Maps to: §3.6.1, §3.6.2; DFARS 252.204-7012(c) 5. How do you log physical access and maintenance?Against the asset itself, so any single machine can produce its own history on demand. Contractors handling CUI on a shop floor fail here for unglamorous reasons. Server room access is recorded on a clipboard. A vendor took a machine away for repair and nobody wrote down whether the drive was wiped first. What evidence does an assessor ask for?Physical access logs, maintenance records tied to named assets and named people, and evidence that media was sanitised before equipment left the site. SP Facilities Manager holds work orders, asset history, preventative maintenance schedules and contractor activity in your tenant. Each asset carries its own record, so the history for one machine can be produced on request instead of reconstructed from memory. Maps to: §3.10.1 to §3.10.4; maintenance requirements at §3.7 6. How do you track security findings through to closure?The same way your safety team already does it: an owner, a date, and proof the fix landed. Something gets flagged in an inspection, someone owns it, there is a deadline, and there is a record showing it was actually fixed. Run that badly and a safety programme falls apart. CMMC asks for the same discipline pointed at security. Where you fall short of a requirement, you write down what you will do about it, who is doing it and by when, then prove it was done. Being straight about it: the standard contains no safety controls, so this is not a mapping exercise. It is the same management loop applied to a different subject. What evidence does an assessor ask for?Every open item with a named owner, a target date and evidence of closure, alongside the assessments that produced them. SP Safety already runs that loop: finding, owner, due date, corrective action, documented closure, with inspection scheduling and audit-ready reporting on top. SP configures the module to your specification during installation, so the same structure carries security findings alongside safety ones. One distinction to hold onto. A remediation plan under the standard is an operational document you manage on your own schedule. A conditional-status plan under CMMC comes with eligibility limits and a 180-day deadline. You will need both. Maps to: §3.12.1, §3.12.2, §3.12.3; 32 CFR 170.21 7. How do you prove requirements were passed down to suppliers?With a contract record that names the supplier, the clause and the date, available the moment a prime asks. Signing a defence contract means taking on obligations, and some of them you pass to your own suppliers. You also keep your assessment score current and confirm it once a year. None of this is difficult. It has to be provable on the day someone asks, and it usually lives in a spreadsheet maintained by one person who already has another job. What evidence does an assessor ask for?Subcontract records showing the clause was passed down, your current score with its assessment date, and the date of your most recent annual affirmation. SP Contract Tracker holds contract records with clause tracking, obligations, renewal dates and automated alerts, visible to everyone who needs them. When a prime asks for evidence on a named supplier, the record is already there. Maps to: DFARS 252.204-7012(m), 252.204-7019, 252.204-7020, 252.204-7021 Where does software stop and your programme start?At the point where evidence has to exist in the first place. Three limits worth stating plainly. Government clouds are not commercial Microsoft 365. Power Platform connector and feature availability differs between them, and it shifts over time. Check availability against your own configuration before designing a workflow around it. Our breakdown of GCC and GCC High compatibility covers which applications qualify and why. No application makes you compliant. The seven above close record-keeping gaps. Encryption, multi-factor authentication, boundary protection and logging sit in the platform and in how you configure it. Scoping deserves a second pair of eyes. It is the decision everything else rests on. SP configures each deployment to the compliance specification you set, and works alongside whoever advises you on assessment, so the two do not pull in different directions. See where your evidence actually sits.Every requirement above comes down to producing the record on the day someone asks for it. SP Marketplace applications run inside your own Microsoft 365 tenant, in GCC or GCC High, configured to your compliance specification during installation. Book a demo to see how they fit your environment. FAQ'sIs CMMC cancelled?
No. Phase 2 and the phases after it are suspended while the programme is reviewed, but Phase 1 remains in force. Self-assessments, SPRS scores, annual affirmations and DFARS 252.204-7012 obligations all apply today, and the underlying rule was never repealed.
Do I need GCC High, or is GCC enough?
It depends on what you handle. GCC High runs on Azure Government with US-person-only operational access, which is what contractors handling CUI under DFARS 252.204-7012 or ITAR-controlled data need. Government Community Cloud (GCC) meets a lower bar and suits many state, local and civilian agency scenarios. Our GCC and GCC High page sets out how SP applications run in each.
Do SP applications count as an external service provider?
SP applications run inside your tenant rather than on SP infrastructure, and they are configured to your compliance specification during installation. External service provider status turns on the specifics of your environment and contracts, so confirm the determination with your assessor rather than assuming it.
0 Comments
The best IT service desk for GCC or GCC High is the one that keeps ticket attachments inside your accredited tenant and produces an asset record an assessor will accept. Every other line in the feature comparison sits below those two. Two terms carry the argument. Your compliance boundary is the set of systems your assessment covers, so anything holding regulated data outside it becomes a separate thing to justify. Controlled Unclassified Information, or CUI, is information the government requires you to protect: not classified, and not yours to store wherever is convenient. Five approaches stay in common use: a shared mailbox and the phone, Microsoft Teams with Planner and Lists, a hosted third-party service desk platform, an application that installs inside your own tenant, and a build of your own on the Power Platform. Where tickets carry attachments containing CUI, hosted platforms leave the shortlist and the choice comes down to building inside your tenant or buying inside it.  Two IT employees looking at a computer monitor Why do the standard service desk rankings not apply in GCC and GCC High?Because most of the products at the top of them cannot install in your environment. Those lists rank on ticket volume handling, integration count, and price per agent, which serves commercial buyers well and a government tenant not at all. A shortlist assembled that way gets rebuilt from scratch the first time procurement asks where the ticket data sits. Start from the environment and the field is small enough to assess in an afternoon. What are Microsoft 365 GCC and GCC High?GCC and GCC High are the government editions of Microsoft 365. GCC serves US government agencies and their contractors with US data residency under FedRAMP Moderate. GCC High runs on a separate US sovereign cloud under FedRAMP High and ITAR, uses Microsoft Entra Government for identity, and is where Microsoft points organizations handling CUI under Department of Defense contracts. Three things change for service desk data specifically. Connector availability narrows. Only connectors that have passed the additional compliance validation appear in GCC High, and Microsoft disables newly released connectors by default in GCC High and DoD until an administrator reviews them. External sharing closes by default. Files in a GCC High tenant generally cannot be shared with commercial tenants, so a ticket that needs a vendor engineer to read a log file becomes a decision rather than a link. Marketplace availability differs. A product you shortlist may not install in your environment at all, so ask on day one instead of after the demo. Smaller defense suppliers are arriving in these environments for the first time, most of them running a commercial help desk they now have to account for. What makes a service desk the right fit in a government tenant?Five criteria decide it, and they are worth applying before any feature list. Where do ticket attachments live?Wherever the vendor puts them, which is the question the feature comparison never asks. A ticket body is usually low sensitivity: a laptop is slow, a printer is offline. The attachment is a different matter, and screenshots showing part numbers, exported configuration files, log extracts and error dumps all arrive without anyone classifying them. Store that content on vendor infrastructure and you have built a route for regulated material to leave your accredited environment. Does the asset record hold up as evidence?Only if the same system that logs the work also maintains it. NIST SP 800-171 expects you to know what hardware you have and where CUI sits on it, and organizations often discover during a first assessment that the inventory they trust is a spreadsheet last updated by someone who has since left. An asset list held inside the service desk, cross-referenced against the tickets and changes that touched each device, becomes evidence. Held anywhere else, it stays a spreadsheet with a better interface. Does it support the 72 hour incident reporting obligation?That depends on what the system remembers. DFARS 252.204-7012 requires a cyber incident to be reported to the Department within 72 hours of discovery, and discovery rarely happens in a security operations center. It happens when somebody raises a ticket about a strange email or a file that will not open. A ticket closed as user error with no trail behind it becomes a problem you find during the reporting window rather than before it. Which connectors does it depend on?More than the vendor usually says. Routing rules, approval steps and notification chains all sit on Power Platform connectors. Where a product depends on connectors unavailable in your environment, the routing is the part that stops. Tickets still arrive and nobody is told about them, which is worse than an outage, because an outage announces itself. Is it available and priced for an organization your size?Rarely, once government authorization enters the picture. The platforms carrying that authorization are built for federal enterprise buyers and priced for them. A 90 person supplier that has just moved into GCC High finds a list short enough to read in a minute, with nothing on it sized for the team it has. What are the options for an IT service desk in GCC and GCC High?Each approach below is assessed against those five criteria. Can you run a service desk on a shared mailbox and the phone?You can, and plenty of small IT teams do it for years. Nothing to buy, no security review, and the mail already sits inside your tenant. What you lose is the record. Nothing shows what was requested, who picked it up, or how long it sat, no request links to the device it concerns, and the same question gets answered twice because there is no knowledge base to point at. Who it suits. An IT team of one or two supporting under fifty people with no assessment pending. When an assessor asks how a suspected incident was handled in March, the answer is a mailbox search. Can Microsoft Teams, Planner, and Lists work as a service desk?For task tracking, yes. A SharePoint list of requests with a Planner board behind it is free, native, already accredited, and solves the visibility problem the mailbox creates. Service management is the part missing. No categorized intake that routes to the right person, no acknowledgement to the requester, no knowledge base to search before raising anything, no asset cross-reference, and reporting you build yourself. Who it suits. Organizations moving off a shared mailbox for the first time, where the problem is visibility rather than evidence. A task board records that something was done rather than what was found, so most outgrow it once volume passes the point where someone has to remember to check it. Can you use a hosted third-party service desk platform in GCC High?Usually not, and the reason is architectural rather than a gap in a roadmap. The deepest feature sets in the category sit here, with workflow, SLA handling and reporting refined across two decades of commercial IT service management. They also run on vendor infrastructure, so ticket content, attachments and asset records sit outside your accredited environment and your security team inherits a vendor assessment. Most publish no government cloud offering, because rebuilding a hosted platform to run inside a customer's tenant is a rewrite. The few carrying government authorization are sold and priced for federal enterprise buyers. Who it suits. Commercial organizations with no sovereignty requirement, and large federal buyers who can absorb an enterprise platform. Where a commercial help desk is already in place and a GCC High migration is coming, it stops being an option on the day the tenant changes, so resolve it while the migration plan is still being written. What is a tenant-native service desk application?A service desk that installs into the Microsoft 365 tenant you already own rather than running on a vendor's infrastructure. It uses services your accreditation already covers, so the security review examines your configuration rather than a new external dependency, and ticket attachments land in SharePoint under the permissions, retention and audit logging you already apply everywhere else. You get categorized intake, routing, asset tracking, change control, a knowledge base and reporting without introducing a second place for regulated content to live. In exchange you follow a vendor's roadmap rather than your own, and the fit is poor for organizations whose document management sits outside Microsoft. Who it suits. Organizations already standardized on Microsoft 365 and SharePoint that need ticket and asset data governed by controls they have already accredited. Should you build your own on the Power Platform?Only with a funded team and a named owner, because the build is the smallest part of the commitment. IT departments ask this more than any other group, and they are right to, because they are the one team with the skills. A SharePoint list with a Power Automate notification flow behind it is a working ticket system in an afternoon, matches your process exactly, stays inside your tenant and uses licenses you already hold. Then intake forms, categorization, routing logic, escalation, SLA timers, asset cross-reference, change approval, the knowledge base and reporting each need maintaining when Microsoft changes something underneath them. Government clouds receive those changes on a different schedule from commercial, so you absorb the rework with no vendor testing it first. The people who would build the service desk are the same people who use it, so when a flow breaks after a platform update, nobody raises a ticket about the ticket system. The team works around it, patches it on a Friday, and carries the fix in their heads until the person holding it leaves. Who it suits. Organizations with a funded Power Platform capability, a support process no product matches, and a named answer to who maintains it in 2030. Compare the license you avoided against the salaried hours to build it plus the hours to keep it running every year after. How does SP IT Helpdesk approach IT service management in GCC and GCC High?How does the ticket cycle run inside your tenant?Start to finish, without leaving Microsoft 365. Employees reach the MyIT portal through SharePoint or Microsoft Teams to search the knowledge base, check open requests and raise a new one. Tickets arrive through the portal or a shared mailbox and route automatically by category, with the requester acknowledged and staff notified at each stage. Staff add work log entries, link knowledge base articles, cross-reference the affected asset and raise a change request where one is needed, and email sent from the ticket threads back into the case. Optional add-ins cover software subscription tracking, Microsoft Teams provisioning through an approval workflow, and external ticket capture by web form, with availability confirmed against your own environment before you plan around them. Is SP IT Helpdesk compatible with GCC and GCC High?Yes. SP IT Helpdesk installs directly into your own Microsoft 365 tenant and runs on native components including SharePoint, Microsoft Teams, Power Automate and Power BI. Where your tenant is GCC or GCC High, the application runs inside that accredited environment and inherits your existing identity controls, data residency rules, conditional access policies and audit logging. GCC and GCC High carry documented feature differences from commercial across SharePoint and the Power Platform, so our team confirms feature availability and connector support against your specific environment before deployment. How do you choose between them? Six questions that settle it1. What actually gets attached to your tickets: screenshots, log files, configuration exports, drawings? 2. Does any of that material carry CUI or export-controlled markings? 3. Where would each approach store those attachments, and who else can reach them? 4. Does your asset inventory need to serve as assessment evidence, and does it do that today? 5. Which connectors does the approach depend on for routing, notification and reporting, and are they enabled in your environment? 6. Who maintains it in two years, and what happens when that person leaves? A yes to question two rules out anything storing attachments outside your tenant, whatever the feature list looks like. Questions five and six then separate building from buying. With a shortlist in hand, ask each vendor to confirm the product installs in your environment rather than assuming marketplace parity with commercial, and that the reporting components render for your users. Does the CMMC Phase 2 suspension change any of this?No. Third-party certification is paused while the current review runs, and only Level 1 and Level 2 self-assessment designations are permitted during it. DFARS 252.204-7012, NIST SP 800-171 Revision 2 and the 72 hour reporting obligation that runs straight through your help desk all remain in force. Frequently asked questionsWhat happens to our help desk data when we migrate to GCC High?
That depends where it currently lives. A hosted platform gives you whatever export the vendor provides, usually ticket records in one file and attachments in a folder, with the threading and the links between tickets, assets and changes lost on the way out. Where the help desk already runs on SharePoint, the content moves with the rest of your SharePoint estate. Ask during migration planning, because the answer decides whether your support history survives the move.
Can external users raise tickets in a government tenant?
External intake is available as an add-in through a web form. Because external sharing is restricted by default in GCC High, how you handle requests originating outside the tenant is a decision to make with your security team rather than a setting to switch on.
How is GCC and GCC High pricing handled?
Separately from commercial pricing, based on your user numbers and environment. Contact us for a formal quotation.
Start with what is attached to the ticket
Every option here logs a request. Fewer of them can tell you where the screenshot attached to last Tuesday's ticket is sitting tonight, who can open it, and what it was attached to. That question narrows the field faster than any feature comparison, and it is the one an assessor asks first.
See GCC and GCC High pricing, or take a closer look at SP IT Helpdesk. Deployment is the easy part. Adoption is decided in the three months afterwards, when the portal is built and half the team is still emailing requests. Four things move the number: give the app an owner in the business, switch the old process off, put the app inside Microsoft Teams where people already work, and use the request and acknowledgment data to find exactly where usage stalled.  a wheel containing sharepoint app logos surrounding the sharepoint logo The Work Starts After LaunchGo-live feels like the finish line. Workflows are configured, permissions are set, users have been trained, and the project is signed off. Three months later, facilities requests arrive by email instead of through the portal. Policies get forwarded as attachments and nobody records who read them. IT tickets land in an inbox rather than the SharePoint helpdesk. The technology is doing exactly what it was configured to do, and the habits have not moved. Give the App an Owner in the BusinessThe fastest lever is a department champion, and it should not be an IT administrator. The best champion is someone who uses the application daily and whose colleagues already ask them how things work. In facilities that might be the person who logs most of the workorders. In HR it is whoever fields the policy questions. A visible advocate inside the department answers small questions before they turn into reasons to go back to email. Switch the Old Process OffRunning the new system alongside the old one is the most common reason adoption stalls. If email still works, a good proportion of people will keep using it, and the records split across two places. Once training is done and the app is stable, make it the only route. Set a date, tell people the date, and after it passes, reply to emailed requests with a link to the form instead of processing them. Habits form quickly when the alternative stops producing a result. Put the App Where People Already AreMost employees spend their day in Teams, Outlook, and SharePoint. Asking them to remember a separate URL adds a step that gets skipped under pressure. SP Marketplace applications are built to run inside Microsoft Teams, so a SharePoint service request system, a facilities portal, or a policy library can appear as a tab in the channel a department already lives in. Logging facilities requests in Microsoft 365 then takes the same effort as sending a chat message. Let the Data Show You Where Adoption SlowsAdoption should not be guessed at. Every SP Marketplace module is built on SharePoint, Power Automate, and Power BI, so request volumes, approval completion rates, resolution times, and policy acknowledgment records are all reportable from the start. Policy adherence software is only as useful as the acknowledgment data behind it, and that data tells you which teams have signed off on the current version and which have not. One department submitting everything by email while the rest use the portal is a training problem in one team, not a system problem. Incomplete acknowledgments in a single site point to a manager who needs a conversation rather than another all-staff reminder. Targeted action works where broadcast reminders do not. Adoption Keeps GoingSuccessful SharePoint deployments carry on being managed after the project closes. Department champions, a retired legacy process, applications embedded in Teams, and monthly usage reporting turn a working deployment into a working department.
SP Marketplace applications sit inside Microsoft 365 by design, which removes one of the larger barriers to adoption before it appears. Employees are asked to change a process, not to learn a new platform. Running two or more SharePoint apps on the same tenant produces something a single app cannot: one permission model, one search across every record, and business information that already relates to itself. A vendor contract sits next to the asset it covers and the policy that governs it, because all three live in the same Microsoft 365 environment.  two people handshaking with the Microsoft teams and sharepoint logos layered over each arm Business Processes Do Not Work in IsolationMost business software solves one problem well. One system holds contracts, another manages company policies, a third tracks buildings and equipment. Each does its job while the information splits across three platforms that were never designed to speak to each other. The work itself refuses to stay in those boxes. A maintenance contract relates to specific assets, and the vendor carrying out the work has to follow internal procedures. Managing those three facts in three systems means someone spends their afternoon reconciling them. One Contract Connects Everything Around ItTake a facilities team managing an external maintenance provider. The signed agreement sits in SP Contract Tracker with service levels, renewal dates, and a named owner, giving the organization a centralized contract repository rather than a shared drive folder. The work itself runs through SP Facilities Manager, where workorders, service requests, and asset records are tracked. Maintenance management in SharePoint means the preventative schedule and the equipment history sit in the same place as the request queue. The vendor also has to follow safety and access procedures, held in SP Policy Manager with acknowledgment records attached. Nobody has to export anything. The relationships already exist because the records share a tenant. One Permission Model Makes Governance ManageableSharePoint-native applications use the same Microsoft 365 security framework as everything else you run. There are no separate user accounts to provision, no second permission matrix to audit, and no orphaned logins when someone leaves. Access runs through your existing directory groups and SharePoint permissions across every module. For IT, that means fewer places for information to be exposed by accident and a shorter list of systems to review at audit time. One Search Across Your Business InformationFinding a document should not depend on remembering which system it was filed in. Because the applications live in the same Microsoft 365 environment, a single search reaches across contracts, policies, assets, and supporting documents. SP Marketplace also provides targeted search web parts, which let you point a search box at specific libraries or lists across different sites. A facilities page can carry a search that returns only facilities records, and an employee resources page can search policies, forms, and department libraries in one query. Connected Records Support Better DecisionsWhen applications share a platform, the relationships between records become visible without anyone building a report. A facilities manager checking asset management in SharePoint can see which equipment is covered by an active maintenance agreement and which is not. Procurement can see a contract approaching renewal before the auto-renew clause triggers. Compliance can confirm that the contractor on site this week has acknowledged the current version of the site safety procedure, using policy manager SharePoint records rather than an email trail. Build a Connected Microsoft 365 WorkplaceSharePoint facilities management, contract tracking, and policy compliance each stand up on their own. Run together on one tenant, they remove the reconciliation work that sits between them and give employees one place to look. That is the point at which SharePoint stops being where documents are stored and starts being where the business runs.
Yes. If your organization runs Microsoft 365, you already own the components a CRM is built from. SharePoint holds structured data and documents. Power Automate handles the routing and the reminders. Power BI does the reporting. Teams gives people somewhere to work. Permissions and identity are already configured, and everyone has already been trained on the interface. The question worth asking is not whether the platform can do it. The question is what sits between those components and a system your sales team will actually use on a Tuesday morning.  What does Microsoft 365 already give you?More than most organizations realize, which is why the question comes up at all. Structured records. A SharePoint list is a database table with a web interface on top. Leads, opportunities, accounts, contacts and activities are all list content. You can define the columns, control who sees what, and relate one list to another. Documents attached to records. Proposals, quotes and signed contracts live in SharePoint natively, next to the record they belong to, with version history and permissions already applied. A CRM that stores documents somewhere separate from where your organization keeps everything else creates a second filing system to maintain. Automation. Power Automate handles the work people forget: notify the rep when a lead is assigned, flag an opportunity that has gone quiet, update a status when a document is approved. It connects to hundreds of other services, so a CRM built this way can talk to the rest of your estate. Reporting. Power BI reads directly from SharePoint. Pipeline by month, activity by rep, revenue by product, all built on the same data rather than an export. A place to work. Teams and SharePoint are where your staff already spend the day. A CRM that lives there needs no separate login and very little training. So why doesn't everyone just build it?Because the components are the easy part. Assembling them into something that survives contact with a sales team is where it gets difficult, and the difficulty shows up later rather than sooner. A working CRM needs a data model that holds up when a lead becomes an opportunity and an opportunity becomes an account, without anyone rekeying information. It needs different views for a rep and a manager, because they want different things from the same records. It needs automation that keeps running when the person who wrote it leaves. It needs reporting that people trust enough to use in a forecast meeting. Most internal builds get the first version right and then stall. The person who built it moves on, the flows break quietly, and the reporting drifts far enough from reality that somebody starts a spreadsheet. Six months later the organization has a half-finished CRM and no obvious owner. That is a maintenance problem rather than a technology one, and it is the reason products exist for this. What should you look for in a CRM built on Microsoft 365?Four things, and they are worth checking before you commit to anything. It installs into your own tenant. There is a real difference between an application that runs inside your Microsoft 365 environment and one that merely connects to it. The first keeps your customer data under the permissions and governance you already set. The second is a SaaS product with a Microsoft logo on the integration page. You can change it without a developer. Ask for a demonstration of somebody adding a field or renaming a stage while you watch. A product that requires a statement of work for small changes will end up dictating how you sell, because changing it will always be more expensive than working around it. It covers what you use and leaves out what you do not. Feature lists are written to win comparisons. Look instead at what a rep touches daily and check that part is quick. The cost does not scale with headcount. Per user pricing means every hire is charged twice, once in salary and once in software. For a small team, a charity or a local government office, that shapes the decision more than any feature. Is this a better route than a standalone CRM?It depends on what you are optimizing for. A large sales organization with dedicated operations staff and a budget for configuration will find plenty to like in enterprise CRM, and the depth is real. Small and medium businesses, not-for-profits and local government teams rarely have any of those things. What they have is a Microsoft 365 subscription they are already paying for, staff who already know the interface, and no appetite for a six month implementation. For that group the calculation is different. Building on a platform you already own means one identity model, one permissions structure, one place the data lives, and no second vendor relationship to manage. This is the route SP CRM Core takes. It installs into your own Microsoft 365 tenancy and runs on SharePoint, Microsoft Teams, Power Automate and Power BI, with leads, opportunities, accounts, contacts, activities and documents tracked from first contact through to closed sale. Link target: https://www.spmarketplace.com/office-365-sharepoint-crmsme.html FAQsDoes Microsoft 365 include a CRM?
Not as a finished product. Microsoft sells Dynamics 365 separately, and it covers organizations of every size, including a Business Central product aimed specifically at small and medium businesses. What a standard Microsoft 365 subscription includes is the platform a CRM can be built on: SharePoint for the data and documents, Power Automate for the workflow, Power BI for reporting, and Teams as the interface. A CRM built on that platform does not require Dynamics.
Can you build a CRM in SharePoint?
Yes. SharePoint lists handle structured records and relate to one another, Power Automate handles the routing, and permissions come from your existing Microsoft 365 setup. The work is in designing a data model that holds together and maintaining it afterwards, which is where most internal builds run out of momentum.
Do you need Power BI licensing for reporting?
It depends how the reporting is delivered. Power BI Pro licensing applies to some publishing scenarios and not others, and some products publish dashboards in a format anyone with access can view. Ask the question directly before you buy, because the answer changes the total cost.
Is a Microsoft 365 CRM secure enough for government use?
An application installed into your own tenant inherits the security posture of that tenant rather than adding a new one. That is why the question of where a CRM runs matters for organizations in regulated environments. Compatibility with government cloud environments should be confirmed with the vendor for the specific product.
Yes, for most small and mid-sized organizations already running Microsoft 365, a SharePoint app can replace a standalone helpdesk, CRM, or contract system. A SharePoint service request system handles tickets, routing, and knowledge base articles. A SharePoint contract management solution handles storage, approvals, and renewal dates. Highly specialized enterprise platforms still have a place at the top end, though far fewer organizations need them than currently pay for them.  the sharepoint logo layered over graphs such as pie charts, bar graphs and line charts in the background. Do You Need Another Business Application?Software accumulates quietly. One system manages customer relationships, another handles IT support, a third stores contracts. Each solved a real problem when it was bought. Together they produce disconnected data, several sets of credentials, and a licensing bill that grows every renewal cycle. If the business already runs on Microsoft 365, the question worth asking is which of these processes could run inside SharePoint instead. Can SharePoint Replace a Helpdesk?For internal IT teams, usually yes. SP IT Helpdesk logs, assigns, and tracks support tickets in one place, routes them to the right IT staff through automated workflows, holds FAQs and self-help guides in an integrated knowledge base, and reports on resolution times and agent performance. Employees raise requests through Teams and SharePoint, which they already have open. The limit is complexity rather than volume. Organizations running advanced asset discovery, ITIL-heavy change management, or deep integrations across dozens of systems will still get more from a dedicated ITSM platform. Can SharePoint Replace a CRM?For businesses with a defined sales process, yes. SP CRM Core tracks leads, opportunities, and accounts, automates follow-ups, and gives a full view of the customer life cycle with customizable dashboards. It connects to Power BI, so sales data sits alongside the rest of your reporting rather than in a separate analytics tool. SP CRM Core SMB is the version built for smaller sales teams and is priced per organization rather than in user batches. Global sales operations spanning multiple regions, or teams that depend on AI-driven lead scoring, will find the ceiling. Most mid-sized sales teams never reach it. Can SharePoint Replace a Contract Management System?Contract management is the strongest case of the three. SP Contract Tracker stores agreements, routes approvals, monitors renewal and expiry dates, assigns owners, and sends automated reminders. Contract management on Microsoft 365 keeps every agreement inside the tenant, under the same retention and permission rules as the rest of your document estate, which removes the awkward conversation about why the legal repository sits outside the compliance boundary. For legal, procurement, finance, and operations teams, a SharePoint contract management solution generally covers the full lifecycle without a separate platform. Who Gets the Most From the Swap?Organizations already standardized on Microsoft 365. The licenses are paid for. Adding a SharePoint-native module costs less than another subscription and needs no new sign-on. Teams cutting subscription sprawl. Replacing three standalone systems removes three renewal negotiations, three admin consoles, and three sets of user accounts. Departments that keep getting told no. Facilities teams often want workorder tracking and cannot justify a six-figure CMMS. SP Facilities Manager gives them facilities management without new software sitting outside Microsoft 365. The same applies to compliance teams looking for policy management software for small business budgets, which is what SP Policy Manager was built for. Organizations with data residency requirements. Everything stays on the tenant, including the application itself. Match the Tool to the RequirementVery few organizations need the largest platform on the market. They need the one their staff will actually open, that IT can govern with the controls already in place, and that does not add a fourth password to the morning routine. SharePoint-native applications will not displace every enterprise system, and they do displace a surprising number of the standalone tools that crept in one department at a time.
Before you install a SharePoint app, check four things: whether it uses your existing SharePoint permissions, where your business data is stored, how upgrades are delivered, and whether it will still work after a tenant migration. Feature lists rarely answer any of these. An out of the box SharePoint solution built natively on Microsoft 365 keeps data, governance, and sign-on inside the environment you already run, which is what protects the investment three years after go-live.  The Microsoft Sharepoint logo on a green background Feature Lists Answer the Wrong QuestionWhen teams compare the best SharePoint apps, the shortlist usually comes down to screenshots and feature counts. Those matter on day one. What decides whether the app is still delivering value in year three is how it sits inside your Microsoft 365 environment. A SharePoint app should extend the platform you already pay for. Four questions separate the apps that do that from the ones that quietly build a second system alongside it. Does the App Use Your SharePoint Permissions?Permissions are one of the strongest reasons to build business applications on SharePoint. Your teams already rely on Microsoft 365 security groups, role-based access, and permission inheritance to control who sees and edits what. An app should work inside those permissions instead of layering its own security model on top. SP Marketplace applications run natively inside SharePoint, so sign-on and governance run through your existing directory rather than a separate user list that someone has to maintain and audit. Where Does Your Data Live?This is the question that separates Platform as a Service from Software as a Service, and it is worth asking early. SaaS applications move your information onto a vendor cloud. You get the software, the vendor holds the data. aaS applications run on infrastructure you already own. With SP Marketplace, the documents, the data, and the product itself all reside on your own Microsoft 365 tenant rather than a third-party cloud. Nothing leaves the environment your compliance team already signed off on. For organizations working under HIPAA, CMMC, or state records requirements, knowing where information sits carries as much weight as any feature comparison. How Are Updates and Upgrades Delivered?Business applications change over time, and so does Microsoft 365. Ask how the app handles both. No-code, configurable applications avoid the rebuild cycle that catches custom SharePoint application development projects. SP Marketplace modules are fully customizable by power business users, so most changes happen in-house without paying a consultant for every adjustment. The applications also evolve alongside the Microsoft 365 platform, picking up new Microsoft capabilities as they are released rather than falling further behind with each Microsoft update. Will the App Survive Tenant Changes?Microsoft 365 environments rarely stay still. Organizations merge, restructure, migrate tenants, or rebuild their SharePoint architecture. Applications built on standard SharePoint components, Power Automate, and Power BI move with the tenant because they are made of the same parts as the rest of your environment. Systems that depend on external infrastructure and their own databases turn a migration into a separate project with its own budget. A Buyer ChecklistBefore you install any SharePoint application, work through these five questions:
Five yes answers usually point to an application that keeps earning its place after the initial deployment. Choose Office 365 Apps for Business That Fit the PlatformSharePoint customization has a reputation for being expensive because so much of it has been custom development wearing a different name. Configurable no-code applications avoid that trap. By choosing office 365 apps for business that are built natively on SharePoint, Teams, and the Power Platform, organizations improve how work gets done while keeping the governance, security, and control that made Microsoft 365 the platform of record in the first place.
|
AuthorGraeme Campbell Archives
September 2026
Categories |
RSS Feed
SP Marketplace Workplace Solutions on Microsoft (Office) 365 are redefining how work is done in over 1000 organizations around the world. See what it can do for you.
|
Social Channels
|
Microsoft 365® is a registered trademark of Microsoft