Microsoft Places for Hybrid Government Workplaces: Governance Before Rollout

Microsoft Places has become a practical option for organisations coordinating hybrid attendance, managing shared desks, and helping staff find colleagues and rooms across a distributed office footprint. For government agencies and regulated enterprises in Western Australia, the appeal is clear: a Microsoft 365 native tool that reduces the friction of hybrid work while surfacing useful workplace analytics. The challenge is that the same signals which make Places useful, such as presence, occupancy, and location, are also the signals most likely to attract scrutiny under privacy obligations if they are collected without restraint.

This article takes an educational view of how to approach Places in a regulated tenant. The central argument is that governance should be settled before rollout, not retrofitted after staff begin generating data. Decisions about what to collect, who can see it, how long it is retained, and why it exists should be documented and approved as part of the deployment, so that the workplace outcome and the privacy outcome are designed together rather than in tension.

Understanding what Places actually collects

Microsoft Places draws on data that already exists across the Microsoft 365 estate, including calendar and meeting information from Exchange, presence and status from Teams, and room and workspace definitions held in Exchange resource mailboxes. When staff indicate where they intend to work, or when connected peripherals and network signals suggest a person is in a particular building, Places can translate that into presence and occupancy insight. It is important to recognise that this is not a single new data store so much as a new lens over signals your tenant may already hold.

Because of that, the governance question is less about whether Places invents new data and more about how it aggregates and exposes existing data in ways staff may not expect. Presence that was previously ephemeral can become a persistent pattern of attendance, and room usage that was operational can become behavioural analytics about individuals. Treating Places as a data amplifier rather than a neutral display helps decision makers frame the right controls, because the risk lives in aggregation, visibility, and retention rather than in the feature itself.

Applying data minimisation before you enable features

Data minimisation is the principle that an organisation should collect and retain only the information it genuinely needs for a defined purpose. In the context of Places, this means deciding in advance whether you need individual level location and presence, or whether de-identified, building level occupancy trends are sufficient to inform decisions about space and hybrid policy. Many workplace planning outcomes, such as understanding average desk utilisation or peak days, can be met with aggregated views that do not single out a named person, and choosing that path reduces exposure considerably.

A useful discipline is to map each Places capability you intend to enable to a documented business purpose and a nominated data owner. If a feature such as colleague location sharing cannot be tied to a clear operational need, the safer default is to leave it disabled rather than switch it on because it is available. Where individual signals are justified, consider making participation transparent to staff, limiting the audience who can view another person's presence, and setting the shortest practical retention period so that historical location trails do not accumulate indefinitely.

Configuring presence, space management, and visibility

Space management in Places relies on well structured room and workspace definitions, sensible building hierarchies, and clean resource mailbox configuration. Getting this foundation right improves the accuracy of occupancy insight and, just as importantly, keeps analytics at the level of spaces rather than people wherever possible. Administrators should review who holds delegated rights over these objects, because the ability to configure buildings and read usage reporting is itself a privileged function that belongs under normal access governance and periodic review.

Presence and visibility settings deserve particular care because they determine how much one colleague can infer about another. Restricting location visibility to teams that have a working reason to see it, rather than exposing it tenant wide, respects the reasonable expectations of staff and reduces the chance of the data being used for informal performance monitoring. It is also prudent to align Places reporting with your existing information protection controls, so that any exported occupancy data inherits the same sensitivity labelling, access restrictions, and audit logging that apply to other corporate records.

Meeting privacy obligations in a WA context

Australian Government agencies and many enterprises are already familiar with the Australian Privacy Principles, which require that personal information is collected for a lawful purpose, used in ways consistent with that purpose, and kept no longer than necessary. Presence and location data about identifiable staff members generally constitutes personal information, so the same expectations of notice, purpose limitation, and reasonable security apply to Places deployments. Western Australian public sector entities should also account for the state's evolving privacy and information sharing framework, and should confirm current obligations with their own legal and privacy advisers before rollout.

Practical governance turns these obligations into artefacts that survive an audit. A privacy impact assessment, a clear staff notice explaining what Places collects and why, a documented retention schedule, and a defined process for handling access or correction requests together demonstrate that the organisation has considered its responsibilities. Approaching Places in this order, with governance settled first and configuration following the approved design, lets agencies gain the hybrid coordination benefits they want while giving staff and regulators confidence that occupancy and location data is being handled with appropriate restraint.

References

• Microsoft Learn: Microsoft Places overview
• OAIC: Australian Privacy Principles