GxP / Guide 9

SharePoint and Microsoft 365 for GxP documents

What SharePoint Online can and can't do for controlled documents and records, library settings that matter, retention labels, audit, and where a validated add-on is needed.

SharePoint holds a lot of GxP content, whether or not anyone planned it: SOPs, validation documents, deviation evidence, training materials, study documents. It can be a sound place for them, but SharePoint out of the box is not a Part 11 compliant document management system. This guide explains what the platform gives you, how to configure it, and where you need procedures or a validated add-on on top.

Decide what SharePoint is for

Write the decision into the system's GxP assessment. The worst position is the common one: effective SOPs in a normal team site, approved by email.

What the platform gives you

• Version history: every change kept as a version with who and when; major and minor (draft) versions; up to 50,000 major versions per library. Tenant and site level version history limits (including automatic trimming) can override library settings, so set them deliberately for GxP sites.
• Require check out and content approval, so only one person edits at a time and drafts stay hidden from readers until approved.
• Retention labels from Microsoft Purview: keep content for a set period, declare items as records (locked from editing and deletion) or regulatory records (cannot be unlocked or relabelled, even by admins), and route expiry to disposition review with proof of disposal.
• Audit: Purview Audit records views, edits, downloads, sharing and permission changes. Retention is 180 days with Audit (Standard), 1 year for SharePoint with Audit (Premium), and up to 10 years with the add-on licence. For GxP records sites, Premium or an export to your own log store is usually needed.
• Supplier evidence: Microsoft's GxP guidelines cover Azure, Dynamics 365 and Power Platform. For SharePoint Online, base the supplier assessment on the Microsoft 365 ISO and SOC reports from the Service Trust Portal (Guide 4).

What it doesn't do on its own

• Part 11 electronic signatures. SharePoint approvals and Power Automate approval flows record who approved and when, but by default they don't show the signature meaning on the record, require re-authentication at signing, or bind the signature to the exact document version the way 11.50, 11.70 and 11.200 expect. You can build this with a validated add-on, or keep signatures on paper or in a validated system.
• A per-item audit trail with reasons for change. Version history shows who and when; the "why" needs a required comment field or a controlled change process around the document.
• Periodic review of documents, training assignment on new versions, or effective dates, unless you add them.

A library baseline for GxP records

For each library that holds GxP records, set and document:

• Versioning on, with major and minor versions, and enough major versions kept for the record's life (set explicitly, not left to automatic trimming).
• Drafts visible only to people who can edit or approve.
• Require check out on.
• Content approval on, if the library holds effective documents.
• A default retention label that matches the retention schedule, declaring items as records once final.
• Permissions through groups, with edit rights limited to the document control role. Sharing with external users off at site level.

Get-SPOGxPLibraryControls.ps1 checks each library against this baseline and flags what's missing:

.\Get-SPOGxPLibraryControls.ps1 -SiteUrl https://sharepointonline.ravindran.in/sites/qms `
    -LibraryName 'Controlled Documents' -RequireApproval -RequireRetentionLabel

For the permission side, the SharePoint script Get-SPOUniquePermissions.ps1 lists everywhere inheritance is broken, which is what an access review of a document site needs.

Retention and records

• Build retention labels from the retention schedule, one per record class (for example GxP record 25 years for clinical documents, GMP batch record for manufacturing), and publish them only to GxP sites.
• Use regulatory record labels sparingly: they can't be removed, even by global admins. Test on a pilot site first.
• Use disposition review so nothing is deleted at the end of retention without a named person approving it, and keep the proof of disposition.
• Retention wins over deletion: items labelled as records can't be deleted, other labelled items that users delete are kept in the site's preservation hold library until retention ends, and a site under a retention policy can't be deleted.

Validating a SharePoint solution

SharePoint Online is SaaS that Microsoft updates continuously, so validation focuses on your configuration and intended use: site structure, library settings, content types, retention labels, permissions, any flows or add-ons. Keep the configuration in a provisioning template or script so it can be re-applied and compared, run the library baseline check after Microsoft 365 changes announced in the Message Center, and include the configuration in periodic review. The general SharePoint notes (SharePoint Online tips and library schemas) cover the underlying administration.