M365 governance & policies

Governance bodies

University of Waterloo Microsoft 365 (M365) governance consists of two committees, Microsoft 365 Operations and Microsoft 365 Steering.

Microsoft 365 Operations

Chair

  • Lisa Tomalty, IST Client Services, Manager, Customer Relations and Support

Membership

  • IST Client Services, Manager, Customer Relations and Support
  • IST Technology Integrated Services, Manager, Infrastructure Applications
  • IST Security, Security Operations Specialist
  • Faculty Representative, Arts Computing Office, Information Technology Specialist
  • IST Instructional Technologies and Media Services, Supervisor, Learning Environment
  • IST Client Services, Service Desks Manager

Microsoft 365 Steering

Chair

Steven Bourque, Technology Integrated Services Director

Membership

  • IST Client Services Director
  • IST Technology Integrated Services Director
  • IST Instructional Technologies and Media Services Director
  • Faculty Representative, Health Computing, Information Technology Director

Microsoft 365 Operations liaison

  • IST Client Services, Manager, Customer Relations and Support

Terms of Reference

The Microsoft 365 Operations Committee is an IST led committee whose primary responsibility is to address various operational matters pertaining to the roll-out of new Microsoft 365 (M365) services, changes to Microsoft 365 services, and addressing issues and requests related to Microsoft 365 services at the University of Waterloo. New service and/or change requests received via the M365 change request form. 

This can include:

  • Supporting the Microsoft 365 Program and projects,
  • approving new apps based on the approved principles for releasing tools from the M365 suite,
  • approving and scheduling changes,
  • reviewing change requests from campus community, and
  • reviewing Microsoft 365 updates that will affect Waterloo.

The committee will also, at times, act in an advisory capacity to the Microsoft 365 Steering Committee. The Microsoft 365 Operations Committee is also a forum in which its members can seek advice of their colleagues on various matters within the scope of its mandate. Normally the committee operates by consensus or by majority vote in instances where consensus cannot be reached.  

The Microsoft 365 Steering Committee is a resource for escalations, budget discussions, approvals (as needed), and to assist with roadblocks.

Principles for releasing tools from the M365 suite

The vision for the Microsoft 365 Program is to align the University of Waterloo’s information technology services with our reputation as Canada’s most innovative university by embracing the M365 suite of cloud applications to increase student and employee efficiency and collaboration, realize cost-savings through the reduction of duplicate services and licensing, and modernize our IT infrastructure, security, and service delivery. 

The following principles are designed to align with this vision:

  1. The goal for adopting Microsoft 365 tools/apps is to enable the University community to work and learn smarter and collaborate more easily. 
  2. IST staff may initiate release of tools/apps based on consultations with clients and reviews of their business processes. In addition, Waterloo’s community has opportunities to provide input on the release of tools/apps. Priority is given to tools that will move the University towards achieving the overall program vision. 
  3. Microsoft 365 tools/apps are preferred over third-party tools offering similar functionality, especially where the University can minimize financial and support loads. 
  4. Agility and responsiveness are balanced with the preceding principles, so barriers are not imposed unreasonably. Where a desired new app is cost-effective and can be released with acceptable privacy and security risks, it should happen quickly. 
  5. Support for apps is clearly stated. If apps are released without support, this must be part of the announcement. 

Statement of use

Expectation of privacy

Information Risk Assessment

An Information Risk Assessment (privacy and security impact assessment) for Microsoft 365 email conducted by Information Security Services and the Secretariat concluded cloud hosting of employee email would meet applicable privacy legislation and University policy. The results of this assessment also apply to the projects included under the Microsoft 365 Program. Please contact IST Communications to request a copy of the IRA documents.

Expectation of use

  • Use of this service is governed by the Guidelines on use of Waterloo computing and network resources.
  • Email should not be used to share or store Highly Restricted data (as defined by University Policy 46, Information Management). Microsoft Teams, OneDrive, and/or SharePoint Online may be used instead.
  • Data stored in this service are subject to Microsoft data retention policies which may change from time to time. There is no capability to restore deleted data beyond the user-accessible facilities (e.g. versions and recycle bin) provided by Microsoft.
  • Users of this service are expected to exercise the utmost care when sharing files, e.g. verify spelling of names and email addresses.