IT Asset Management Sharepoint Template

Standard Operating Procedure: Enterprise IT Asset Management (ITAM) SharePoint Template Deployment & Lifecycle Governance

---

1. Executive Summary & Purpose

1.1 Objective

This Standard Operating Procedure (SOP) defines the institutional requirements for provisioning, deploying, and governing the Enterprise IT Asset Management (ITAM) SharePoint Template across Template Registry environments. This framework ensures cryptographically secure, auditable, and immutable tracking of hardware, software, cloud, and digital assets throughout their lifecycles.

1.2 Purpose

Unstructured asset tracking introduces compliance gaps, financial audit failures, and operational vulnerabilities. This SOP establishes a standardized, repeatable methodology to deploy a pre-configured SharePoint-based ITAM registry integrated with Power Automate workflows and Microsoft Entra ID. Adherence to this protocol minimizes organizational risk, guarantees SOC 2 and ISO/IEC 27001 compliance, and maintains data integrity.

---

2. Scope & Prerequisites

2.1 Scope

This document governs all ITAM SharePoint deployments across global enterprise tenants managed by Template Registry. It applies to all physical endpoints, virtual assets, SaaS licenses, and IoT hardware.

2.2 Prerequisites & Environment Requirements

• Licensing: Microsoft 365 E5 or Office 365 Enterprise E3 with SharePoint Advanced Management add-on.
• Permissions: Global Administrator or SharePoint Administrator rights required for tenant-level asset hub creation.
• Dependencies:
  • Access to Template Registry Global Asset Repository (https://templateregistry.sharepoint.com/sites/ITAM-Source).
  • Active Microsoft Entra ID (formerly Azure AD) tenant with dynamic security groups enabled.
  • Power Automate Premium license for enterprise webhook integrations and automated lifecycle triggers.

---

3. Roles & Responsibilities

---

4. Step-by-Step Procedure

Phase 1: Environment Preparation & Provisioning

• 1.1 Authenticate into the SharePoint Admin Center using an administrative account with elevated privileges.
• 1.2 Navigate to Sites > Active sites > Create and select Team site (classic or modern communication site based on enterprise standards).
• 1.3 Assign the site URL designation: https://[tenant].sharepoint.com/sites/Enterprise-ITAM.
• 1.4 Apply the Template Registry PnP Provisioning Package (ITAM_Core_v3.2.pnp) via the SharePoint PnP PowerShell module:

  Connect-PnPOnline -Url "https://[tenant].sharepoint.com/sites/Enterprise-ITAM" -Interactive
  Invoke-PnPSiteTemplate -Path "C:\Templates\ITAM_Core_v3.2.pnp"
  

• 1.5 Verify core lists are populated: Hardware_Registry, Software_Licenses, Cloud_Assets, and Disposal_Log.

Phase 2: Schema Configuration & Metadata Taxonomy

• 2.1 Navigate to the Hardware_Registry list and verify the presence of mandatory enterprise columns:
  • AssetTag (Single line of text, Indexed, Enforce unique values)
  • SerialNumber (Single line of text, Indexed)
  • AssignedUser (Person or Group, Enforce selection of users only)
  • AssetStatus (Choice: In Stock, Deployed, Maintenance, Retired, Decommissioned)
  • AcquisitionCost (Currency, USD)
• 2.2 Bind the Managed Metadata Service (MMS) term store to the AssetCategory column, utilizing the global term set TR-ITAM-Taxonomy-v2.
• 2.3 Enable content types and configure document templates for software compliance certificates and hardware purchase orders.

Phase 3: Security & Permission Matrix Implementation

• 3.1 Break inheritance on the SharePoint site and remove default 'Everyone except external users' permissions.
• 3.2 Assign the custom permission levels mapped to enterprise Entra ID security groups:
  • ITAM-Admins: Full Control
  • ITAM-Asset-Managers: Edit
  • Enterprise-All-Users: Read (Restricted to non-sensitive hardware request views)
• 3.3 Enable Information Rights Management (IRM) on the site collection to prevent unauthorized local downloading of asset inventory reports.
• 3.4 Configure site collection auditing via PowerShell to log all item access, modification, and deletion events:

  Set-PnPSite -AuditFlags Update, Delete, CheckIn, CheckOut, ProfileChange
  

Phase 4: Automation & Integration Setup

• 4.1 Import the Power Automate solution package (ITAM_Lifecycle_Automation_v3.zip) into the Power Automate maker portal.
• 4.2 Establish connection references for Microsoft Dataverse, SharePoint, and Microsoft Teams.
• 4.3 Configure the automated depreciation trigger workflow to run on the 1st of every month, calculating linear depreciation for assets logged in Hardware_Registry.
• 4.4 Link the Microsoft Entra ID dynamic group Corp-Device-Sync to the asset ingestion API endpoint to automatically flag unassigned hardware detections.

---

5. Quality Assurance & Pro-Tips

5.1 Quality Assurance Checklist

• Run the SharePoint Modernization Scanner against the deployed ITAM site to ensure zero deprecated JavaScript dependencies remain.
• Execute a test asset intake cycle: Create, modify, audit-log check, and soft-delete an asset record. Confirm automated notification dispatch to itam-alerts@templateregistry.internal.
• Verify that list view thresholds (5,000 items) are mitigated by confirming indexed columns are properly applied to AssetStatus, AssetTag, and AssignedUser.

5.2 Pro-Tips & Best Practices

• Pro-Tip 1 (Indexing): Always index columns before importing legacy CSV asset data exceeding 1,000 rows to prevent database throttling and locking errors.
• Pro-Tip 2 (Views): Construct targeted filtered views based on AssetStatus == "Deployed" rather than displaying flat lists to reduce client-side DOM render latency.
• Pitfall Avoidance: Never assign granular item-level permissions within SharePoint ITAM lists; manage all access control strictly through Entra ID security group synchronization.

5.3 Metric Thresholds

• Page Load Performance: Document Library and List views must render in $< 1.5$ seconds under standard enterprise network conditions.
• Data Accuracy: Automated reconciliation match rate between Entra ID device joins and SharePoint ITAM records must maintain $\ge 99.5%$.

---

6. Frequently Asked Questions (FAQ)

Q1: What is the protocol if a deployed asset's serial number conflicts with an existing entry during bulk CSV import?
A: The bulk import script is hardcoded to halt execution upon encountering a duplicate AssetTag or SerialNumber to preserve database integrity. Review the error log generated in the script execution terminal, isolate the conflicting row in the staging CSV, resolve the discrepancy against the physical asset ledger, and re-run the incremental import script.

Q2: How are permissions dynamically adjusted when an asset manager transitions to a different department?
A: Because access is governed strictly via Microsoft Entra ID dynamic and assigned security groups (as mandated in Phase 3), you do not modify permissions directly inside SharePoint. Update the user's group membership in the Entra ID admin center; access tokens update across the tenant within 15 minutes.