Microsoft SharePoint spreads 'virally,' complications ensue

SharePoint proliferation leads to uncontrolled content, compliance challenges, analyst firm says

The analyst firm CMS Watch is claiming the newest version of Microsoft's SharePoint is spreading "virally" throughout enterprises, catching IT departments off guard and introducing risks related to uncontrolled content and regulatory compliance.

Microsoft Office SharePoint Server (MOSS) 2007 is a good product for document collaboration and Web content management, but may be a victim of its own success, says CMS Watch analyst Alan Pelz-Sharpe, lead author of a new report analyzing various enterprise content management technologies.

In big enterprises users are deploying it on their own, allowing business-critical information to reside in servers where it isn't properly archived, he says.

"SharePoint's really easy to use and it's a pretty good product, to be fair," Pelz-Sharpe says. "The ease of use and ease of deployment means IT doesn't need to deploy it, and people are doing their own thing."

CMS Watch says its clients include a North American bank that found "more than 5,000 uncontrolled and unaudited instances of SharePoint," and a major energy company that "reported finding more than 15,000 previously undetected instances of SharePoint."

SharePoint can be deployed by users in large enterprises without IT noticing because in some packages the seat price is so small no one is monitoring new instances, Pelz-Sharpe says.

The uncontrolled versions of SharePoint make it hard to comply with legal discovery requirements, he says.

IT departments are certainly to blame for lacking policy and governance, Pelz-Sharple says, recommending enterprisewide content strategies with archiving policies that can be managed from the back office. When an employee hits "save," the file should be stored on something that's centralized and controlled, rather than a stand-alone server, he says.

Still, CMS Watch thinks Microsoft should take some blame for not providing better enterprise management services.

"In the future [Microsoft] can ensure that there are more federated elements to SharePoint so that when it grows at least there are some links and feedbacks from each new instance so you can track it," Pelz-Sharpe says. "Automated archiving would be a big thing."

Microsoft officials were not available for an interview this week but released a statement saying the CMS Watch report contains "mischaracterizations and inaccuracies."

"SharePoint has secured check-in and check-out and has additional security features that enable data to be protected and discovered in a very manageable way -- and in fact you can manage all of your [Windows SharePoint Services] instances for MOSS," the Microsoft statement reads.

CMS Watch says viral proliferation of SharePoint is nothing new, going back to the 2003 version. But Pelz-Sharpe says the "problem is becoming acute now" with the popularity of the 2007 product. SharePoint is a runaway success, reportedly generating US$800 million in revenue this year for Microsoft, with 85 million licenses across 17,000 customers, the CMS Watch report states.

"Already some enterprises spend huge sums of money to extract themselves from viral-like deployments of SharePoint 2003 running rampant across their network," the CMS Watch report states. "The danger is that this [2007] product will simply make those kinds of bad situations worse. Though Microsoft argues that these kinds of situations are really a lack of analysis and planning etc., we think it a little disingenuous to ignore the sales efforts that have contributed to some deployment mistakes."

Pelz-Sharpe acknowledged his firm doesn't have hard numbers to demonstrate SharePoint proliferation, but says "there's a mountain of anecdotal evidence ... it's not that hidden."

CMS Watch, which says it maintains a vendor-neutral stance by refusing to take money from vendors, did defend Microsoft from some criticism related to SharePoint. "Competitors have unfairly criticized that MOSS 2007 'requires' an upgrade to Office 2007 on the client side. This is not true," the CMS Watch report states. "Microsoft does typically demo the product with Office 2007 on the desktop, but in fact, the new version of Office adds fairly little to the participant experience beyond offline synchronization of Outlook."