Looking across the common failure patterns, there's a single theme: legacy script patterns that nobody had revisited in years. The solutions that broke were rarely recently built, they were older integrations, older web parts, scripts embedded when SharePoint was configured years ago and then forgotten.

CSP enforcement didn't create new problems; it surfaced old ones. That's actually the point. The report-only window from late 2025 through 28 February was designed exactly for this: a chance to audit before enforcement hit. Teams that used that window had nothing to worry about on 1 March. Teams that didn't are doing triage now.

When Microsoft announced SharePoint Online's Content Security Policy enforcement in early 2026, they included a lifeline for organisations that needed more time: a Set-SPOTenant -DelayContentSecurityPolicyEnforcement $true flag that pushed enforcement from 1 March to 1 June 2026. If your IT team enabled that flag, you bought yourself 90 days.

Those 90 days are now running out.

The purpose of the delay was to give organisations time to audit their environments, fix non-compliant scripts, and test changes, not to skip preparation entirely. If you haven't started yet, this post is your starting gun.

The pattern we've seen with 1 March enforcement is that the teams who struggled were the ones who started late. Trusted Script Source changes can take up to 24 hours to propagate across a tenant. If you're making changes on 30 May and something doesn't propagate in time, you have no margin for error.

Eight weeks sounds like plenty of time. In practice, the audit usually surfaces more than expected, vendor responses take longer than expected, and internal sign-off processes take time. Start now.

If your SharePoint environment includes solutions from third-party vendors, analytics tools, chatbots, form builders, or similar, those vendors may need to update their products to be CSP-compliant. Reach out to them with the specific violation URLs from your Purview audit and ask for a compliance timeline.

In the meantime, you can temporarily register their script sources as trusted, but the long-term fix needs to come from their end if their solutions use inline scripting patterns.

Here's something that surprises people who haven't been through a full SharePoint migration: the actual moving of data is often not the hardest part.

Before you migrate a single document, you need to know what you have. That means auditing every site collection, every document library, every custom permission level, every workflow, every Add-In, every integration that touches SharePoint. In environments that have been running for five or ten years, that audit alone can take weeks.

Then comes the conversation about what to bring across, what to rebuild, and what to retire. Classic SharePoint Designer workflows won't survive the migration to SharePoint Online as-is. They need to be rebuilt in Power Automate. Add-Ins built on the retiring framework need to be redesigned using modern solutions. InfoPath forms need to be replaced.

None of that is technically impossible. All of it takes time.

• April 2, 2026: SharePoint Add-Ins and classic SharePoint 2013 workflows retire. Any business process built on these frameworks stops working. This isn't a 'soft' retirement with a grace period — it's a hard cutoff.

Let's talk about what happens when organisations start their migration planning in Q1 2026 instead of now. A few things tend to happen:

A properly planned SharePoint migration isn't just a technical exercise. It has several distinct phases, and each one has genuine business value:

• Environment assessment: Understanding exactly what you have — content, customisations, permissions, integrations, and ROT (redundant, obsolete, and trivial) content that doesn't need to move at all.
• Workflow and Add-In inventory: Cataloguing every automated process and identifying what needs to be rebuilt in modern tools like Power Automate and Power Apps.
• Migration path decision: Choosing between SharePoint Online, SharePoint Subscription Edition, or a hybrid approach based on your compliance requirements and cloud strategy.
• Phased execution: Running pilot migrations, validating, then executing in phases with proper testing at each stage.
• Change management and adoption: Making sure your users understand what's changed, why it changed, and how to work effectively in the new environment.

Start that process now and you have time to do each of those things properly. Start it in January 2026 and you're making hard choices under pressure.

Whether you are a large association, an SME, or a sector body navigating complex stakeholder environments, the challenge with Microsoft 365 is rarely the technology itself. It is adoption; it is knowing which tools to prioritise; it is having a partner who understands your context before prescribing a solution.

That is why our approach to IT support (for the agricultural sector in South Africa and across every industry we serve) starts with listening. We ask the hard questions: Where are the gaps? Which tools are going unused? What is creating friction for your team day-to-day? And what does a realistic, achievable roadmap actually look like for your organisation?

For our A Team clients, this kind of session is part of the package; not an add-on, not a special occasion. It is what a premium, long-term Microsoft 365 support relationship looks like in practice.

Quietly, intentionally, and with a clear plan. No fanfare. Just the work.

Not every organisation has the same needs, and that is exactly the thinking behind our Blue Sky Events. Blue Sky is GTconsult's exclusive, interactive Microsoft 365 workshop format, designed to bring certified M365 specialists directly to your team (on-site or virtually) anywhere in South Africa.

Every Blue Sky session is built around your organisation's specific challenges and goals. There is no generic content, no off-the-shelf slides; just practical, hands-on learning with actionable takeaways your team can implement immediately. Whether that is streamlining collaboration in Teams, unlocking automation through Power Automate, or getting more from tools your team already has access to, we build the session around what actually matters to you.

Blue Sky Events are open to everyone: existing GTconsult clients and organisations simply exploring what better Microsoft 365 support in South Africa could look like for them.

Yes. GTconsult provides Microsoft 365 support and M365 consulting across South Africa, including KwaZulu-Natal, the Western Cape, and beyond, both on-site and virtually.

We work across sectors including agriculture, financial services, insurance, retail, and more. Our M365 consulting approach is tailored to each organisation's context; it is never a one-size-fits-all solution.

No. Blue Sky Events are open to any organisation interested in getting more from their Microsoft 365 environment. Whether you are an existing client or brand new to GTconsult, there is a session for you.

There's a version of this conversation that happens after an incident. After a breach. After data has been exfiltrated, or systems have been locked down by ransomware, or a client calls asking why their data appeared somewhere it shouldn't.

That conversation is expensive. Remediation is expensive. Reputational damage is expensive. Regulatory exposure (especially under POPIA) can be very expensive.

A penetration test, run proactively, finds the same problems before they become incidents. It's the difference between fixing a lock and explaining to your clients why their data is gone.

We've seen it go both ways. Businesses that test regularly catch things early and fix them quietly. Businesses that don't, often find out the hard way — and at the worst possible time.

It's a fair question because the phrasing can feel a bit abstract. Here's what it means in plain language:

After July 14, 2026, Microsoft will no longer release security updates for SharePoint Server 2016 or 2019. They won't fix bugs. They won't patch vulnerabilities. If a cyber threat specifically targets your version of SharePoint, Microsoft will not respond. You're on your own.

Your server won't suddenly shut down. Everything will look exactly the same the morning of July 15. Files will still open. Sites will still load. But underneath that familiar interface, you'll be running a platform that no longer has anyone watching its back.

Here's what makes this even more urgent: July isn't the only deadline you need to worry about.

On April 2, 2026, Microsoft is retiring the SharePoint Add-In model and classic SharePoint 2013 workflows- permanently. If your environment relies on workflows built in SharePoint Designer, approval processes tied to the Add-In framework, or third-party add-ins using Azure ACS authentication, those things will stop working before July even arrives.

April 2, 2026. That's less than a year away as you're reading this.

This affects more organisations than you'd think. A lot of business-critical processes, finance approvals, HR routing, records management, procurement sign-offs, were built on classic SharePoint workflows. When these retire, they don't just slow down. They break.

• SharePoint Server Subscription Edition (SE): The on-premises path for organisations with compliance requirements or data sovereignty constraints. Released in 2021, it runs on Microsoft's Modern Lifecycle — no fixed end-of-life date.

• Hybrid approach: Combining on-premises SharePoint SE with SharePoint Online for organisations that need a phased transition or have specific data that must remain local.

If your SharePoint environment went down tomorrow, not a migration, just an unplanned outage after July 2026, how long could your business operate? Who would you call? What would your IT team do without a Microsoft support ticket to open?

That's the risk you're accepting by waiting.

At GTconsult, we've spent 15 years helping organisations navigate SharePoint migrations. We know what a well-planned migration looks like, and we know what a rushed one costs. The difference is almost always time — specifically, how much of it you have left when you start.

Let's talk about what's actually happening in most organisations.

Your team opens Outlook. They jump into a Teams meeting. Maybe someone opens a Word doc or an Excel spreadsheet. And that's... pretty much it.

But your Microsoft 365 licence — whether it's Business Standard, E3, or E5 — includes a lot more than email, meetings, and documents. We're talking SharePoint for document management and intranets, OneDrive for personal cloud storage (up to 1TB per user), Power Automate for workflow automation, Microsoft Forms for surveys and data collection, Planner and To Do for task management, Lists for structured data tracking — and depending on your plan, even more.

Most of these tools are sitting there, fully licenced, fully available, and completely untouched.

Here's where it gets frustrating. Organisations will pay for a Microsoft 365 E3 licence and then also pay separately for Dropbox, Trello, SurveyMonkey, or Zoom — tools that do what their existing licence already covers.

Not because Microsoft 365 can't do it. But because nobody on the team knows it can.

Think about that for a second. You're essentially paying twice for the same capability — once through your M365 licence and again through a third-party subscription — just because your people haven't been shown what's already available.

And it's not their fault. Nobody sat them down and said, "Hey, you know that thing you're using Dropbox for? OneDrive does that. And it's already included in what we're paying for." Or, "That approval process you're running over email? Power Automate can handle that automatically."

Let me give you a few examples of what most teams are missing, even on a standard Business Standard or E3 licence:

It's not about becoming a power user overnight. It's about making sure your people understand the basics properly and then building from there.

It starts with the fundamentals: knowing where to save files (OneDrive for personal, SharePoint for team), understanding how Teams, SharePoint, and OneDrive work together, and being able to share files with a link instead of an attachment.

Then you layer on productivity skills: co-authoring documents in real time, using Planner for project tracking, setting up basic automations, organising SharePoint sites so people can actually find things.

And for the people who want to go further — your site owners, your digital champions, your IT-adjacent team members — there's governance, security settings, and advanced automation with Power Automate and eventually Copilot.

The point is, it's a journey. Not a single event.

Before you do anything else, run a quick mental audit. Ask yourself:

Are we paying for any third-party tools that duplicate what Microsoft 365 already offers? When was the last time our team received structured M365 training? Can our people confidently explain the difference between OneDrive and SharePoint? Does anyone on the team know how to set up a basic Power Automate flow? Are we using SharePoint for document management, or is it just a dumping ground?

If most of those answers make you uncomfortable, that's your sign.

Content Security Policy is a browser-level security standard that controls which scripts a page is allowed to load and execute. It's one of the most effective defenses against cross-site scripting (XSS), clickjacking, and code injection attacks.

Until now, SharePoint Online has been running CSP in report-only mode — logging violations without actually blocking anything. That changes on 1 March when enforcement goes live. After that date, any script that doesn't comply with the CSP rules will be blocked by the browser, potentially breaking custom web parts, third-party tools, and SPFx solutions.

Step 1: Check the Browser Console

Open any SharePoint page that uses custom solutions, press F12 to open Dev Tools, and look for CSP violation messages in the Console tab. You'll see entries like:

• "Loading the script '<url>' violates the following..."
• "Executing inline script violates the following Content Security Policy directive..."

Step 2: Use Microsoft Purview

For a tenant-wide view, go to Microsoft Purview (purview.microsoft.com) and create an audit report filtering for the activity "Violated Content Security Policy." This gives you a comprehensive list of every page and script generating violations across your environment.

Step 3: Review the Directives

Pay attention to both Directive 12 (script-src) and Directive 13 (style-src) violations. Both are relevant — Directive 13 applies to inline code constructs that will also be blocked under enforcement.

Add Trusted Script Sources

Go to SharePoint Admin Center → Advanced → Script sources and add any external domains your solutions depend on. A few things to note:

• You can add up to 300 entries.
• Overly broad wildcards like*or*.domainare not allowed.
• Use targeted wildcards to consolidate where possible.
• If a script loads from a CDN, you need to trust that specific CDN domain.

Refactor Inline Scripts

This is the big one. Any JavaScript embedded directly in HTML, event handlers, or injected viainnerHTMLordocument.write() must be moved into external.jsfiles hosted at a trusted location. There's no shortcut here —unsafe-inlineis not permitted, and Microsoft will not provide nonce values.

Validate Auto-Trusted Sources

If you usecdnBasePathwithout a trailing slash, the auto-generated Trusted Script Sources entry may not match correctly. Double-check these entries manually after deploying your solutions.

This pushes enforcement to June 1, 2026. It's a one-time delay — use it wisely and don't treat it as a permanent fix.

Once enforcement begins, end users may see broken functionality or warning messages on pages that rely on non-compliant scripts. Get ahead of this with proactive communication:

• Explain that this is a security improvement, not a system failure.
• Provide a clear path for users to report issues.
• Coordinate with any third-party vendors whose solutions run in your SharePoint environment.

The typical approach looks something like this: open the Microsoft Defender portal, see a list of recommendations, pick the ones worth the most points or that seem easiest, and start implementing.

Three months later, your score has barely moved. Or it moved briefly and then dropped back down. Or you've spent weeks on improvements that broke critical workflows and had to be rolled back.

The problem isn't lack of effort. It's lack of strategy.

Effective Secure Score improvement requires understanding three things most teams skip:

Get any of these wrong and you'll spend more time fixing problems than you saved by implementing the recommendation.

This pattern repeats across every recommendation in your Secure Score. What looks like a configuration change on the surface requires strategic thinking about business impact, technical dependencies, and change management.

IT teams often start with "quick wins"—recommendations that promise high point values with supposedly minimal effort.

The problem is that "quick" depends entirely on your environment's current state and complexity. Blocking legacy authentication might take 15 minutes in one organization and require weeks of application modernization in another.

More importantly, chasing points without understanding impact leads to a dangerous pattern: implementing changes that raise your score but don't actually improve your security posture in meaningful ways for your specific risk profile.

The organizations that successfully improve their Secure Score don't focus on quick wins first. They focus on right wins—improvements that align with their actual threat landscape and business priorities, regardless of point value.

Join our security analyst, Kyle Farr, on 10th of February 2026 for a live demonstration of strategic Secure Score improvement:

• Current state analysis - How to assess your score breakdown and identify what actually matters for your risk profile (not just point values)
• Prioritization framework - The decision criteria for determining which recommendations to tackle first based on business impact and technical dependencies
• Live implementation walkthrough - Watch a real security control get configured with proper testing and rollback planning
• Monitoring and sustainability - Building the processes that catch drift before it degrades your security posture
• Q&A for your specific challenges - Get answers about your environment's blockers and constraints