Hire SharePoint and Microsoft 365 Developers

How SharePoint work actually arrives

SharePoint work is rarely requested as SharePoint work. It arrives as a department that has built something real on a site — an approval process, a register, a document workflow that the business now depends on — with no owner, no test environment and permissions that grew one exception at a time.

Inventory comes before development

The first job is usually inventory rather than development. Which sites are live, what is actually stored in them, who can reach it, and what would happen if the person who built the flow left. On a large estate the honest answer to the last question is often that nobody knows, and establishing it is the work that has to happen before anything is migrated or rebuilt.

The inventory that is useful is not a site list. It is a list of the things people would notice if they stopped working, with an owner’s name against each one. Almost everything else can be archived without an argument, and the argument is what makes governance projects run long.

Should this be a SharePoint solution at all

The second is deciding what should be a SharePoint solution at all. A great many internal tools are on SharePoint because that was what was available, and would be better as a small application. Others are exactly right where they are and need governance rather than rewriting. Someone who reaches for the same answer both times is not much use.

The distinction that usually decides it is whether the thing is really about documents. Document storage, versioning, retention and co-authoring are what the platform is genuinely good at. A register with a state machine, validation rules and a reporting requirement is an application that happens to be stored in a list, and it will keep straining against the list until somebody admits that.

Permissions are where the genuine risk sits

The third is permissions, which is where the genuine risk sits. Broken inheritance, sharing links that outlived the person who created them, and a site collection where the fix for an access problem was to widen access. In a regulated environment that is the finding, and it is invisible until someone goes looking for it.

Anonymous and organisation-wide sharing links are the specific thing worth auditing first, because they survive the departure of whoever created them and they do not appear in a permissions view that only shows groups.

What a migration from on-premises actually involves

Content moves easily. What does not move easily is everything that gave the content meaning: custom permissions, metadata columns nobody documented, workflows built in a designer that no longer exists, and paths long enough that the target refuses them.

So the sequence that works is to profile first, decide what is not coming, agree the metadata and retention model in the target, and then move. Migrating everything and tidying afterwards is the common plan and it reliably produces a new estate with the old estate’s problems, plus a period during which nobody is sure which copy is authoritative.

SPFx and Graph, used where they earn it

SPFx is the supported route when a page genuinely needs behaviour the platform does not provide, and Microsoft Graph is the right answer when the requirement is really data rather than a page. Both are worth reaching for deliberately. Neither is a good response to a layout preference, because a web part is a deployment artefact with a lifecycle and a page is not.

When you should not staff this role

If a department needs a shared document library with sensible retention, that is administration, not development, and it should not become a project.

If the tool in question is genuinely an application — external users, a real data model, a life expectancy measured in years — then building it on SharePoint because the licence is already paid for is a decision that gets re-examined expensively later.

The case for this role is an estate nobody has inventoried, a migration with real permission and metadata complexity, or a set of business-critical flows and lists that currently have no owner and no way to be tested.