Building Your HSE Management System in Microsoft 365:
What You Gain, and What You Still Own

The problem we see most often

 

Ask a growing company where its safety records live and the honest answer is usually "a few places." Inspection forms sit in a shared drive. Incident reports arrive by email and stay there. Training records live in a spreadsheet on one coordinator's laptop. Corrective actions are tracked in someone's head until the next audit.

 

That works until it doesn't. A client prequalification asks for three years of incident data and training records by Friday. An auditor wants to see which revision of a procedure crews were using last spring. The person who built the spreadsheet takes a job somewhere else.

 

Most of these companies already pay for Microsoft 365. They use Outlook, Teams, and OneDrive every day. What they often haven't done is use the same platform to run the HSE program itself. This article walks through why that can make sense, and what you still have to get right.

 

Ownership: your records stay in your environment

 

When you build on Microsoft 365, your HSE records live in your organization's own tenant, alongside the rest of your business data, under the agreements you already have with Microsoft.

 

Microsoft's Trust Center states that it uses customer data only to provide the agreed services and compatible purposes, and that it does not mine customer data for advertising. If a subscription ends, Microsoft keeps the data in a limited-function account for 90 days so the customer can extract it, then deletes it.

 

That matters for an HSE program because your records outlive any single tool. Before committing to any platform, including standalone safety apps, it's worth asking a plain question: if we leave, how do we get every record out, in what format, and how fast? With Microsoft 365, the answer is your own SharePoint lists and libraries, which you can export and keep.

 

Security: strong tools, but you hold half the job

 

Microsoft 365 gives you serious security capabilities. It does not make a system secure on its own, and no platform does.

 

Microsoft describes this as shared responsibility. For software-as-a-service like Microsoft 365, Microsoft manages the physical datacenters, network, and operating systems. The customer always keeps responsibility for its data, its user accounts and identities, and how the service is configured.

 

In practice, for an HSE system, that means:

 

• Turn on multifactor authentication for everyone. Security defaults are available to all Microsoft 365 customers. If you need finer control, such as requiring MFA only off the corporate network or blocking sign-ins from unmanaged devices, Conditional Access does that. It requires Microsoft Entra ID P1, which is included with Microsoft 365 Business Premium.
• Design permissions on purpose. Incident investigations, medical case notes, and disciplinary records should not sit in the same folder as the toolbox talk library. SharePoint lets you separate them by site, library, or list, and control who sees what.
• Plan for contractors. Subcontractors often need to submit documents or see site-specific requirements. Guest access can give them exactly that, without access to the rest of your system.

 

A Microsoft 365 HSE system is as secure as its configuration. That is the honest version of the security story, and it's the one to hold any provider to.

 

Governance: document control and records you can defend

 

HSE programs live and die on two governance questions: are people using the current version of the procedure, and can we produce the records when asked?

 

Document control. ISO 45001 requires organizations to control their documented information, including versions and approvals. SharePoint document libraries keep version history automatically, so you can see what changed, when, and by whom, and roll back if needed. Combined with a simple approval workflow, that gives you a controlled document system without a separate product.

 

Records retention. Retention requirements are real and specific. Under OSHA's recordkeeping rule (29 CFR 1904.33), employers must keep the OSHA 300 Log, the 300A summary, and 301 incident reports for five years following the end of the calendar year the records cover. Microsoft Purview retention labels let you apply rules like "keep for this long, then review or delete" at the item level, so retention is built into the system instead of relying on someone remembering.

 

Retention features vary by Microsoft 365 plan, so confirm what your subscription includes before you design around them.

 

Operations: one system people already know how to use

 

The biggest practical advantage is often the least technical. Your people already sign in to Microsoft 365 every day.

 

A well-built Microsoft 365 HSE system typically looks like this:

 

• Field forms in Power Apps for inspections, observations, and incident reports, completed on a phone or tablet and saved to SharePoint lists.
• Automated follow-up in Power Automate: a new incident notifies the right supervisor, a corrective action gets an owner and a due date, and overdue items escalate instead of disappearing.
• Training and competency tracking in one list, with reminders before certifications expire.
• Leadership dashboards that pull from the same data, so the numbers in the monthly report match the records underneath them.

 

Because everything sits in one platform, you avoid re-keying data between disconnected tools, and you are not training crews on yet another login.

 

The licensing reality

This is where honest planning saves money. Most Microsoft 365 business plans let you build Power Apps and Power Automate solutions that use standard connectors, which cover common Microsoft 365 services such as SharePoint, Outlook, and Teams. Premium connectors, custom connectors, on-premises data gateways, and full Dataverse databases require standalone Power Apps or Power Automate licenses.

 

Design matters here. An HSE system built on SharePoint lists and standard connectors can run on the licenses many companies already own. One built on premium features can add per-user costs quickly. Decide that up front, not after rollout.

 

Owning versus leasing your HSE system

 

The usual objection to building in-house is upkeep, and it's fair: someone has to maintain a Microsoft 365 system. But a subscription safety platform isn't maintenance-free either. You're paying for that maintenance in the subscription price, every year, for as long as you use it.

 

That's the part that often gets missed. A subscription EHS platform works a lot like a car lease. The payments never stop, you never own the asset, and when you walk away, you hand it back. Your records may come with you, but often as a bulk export that's hard to put back to work. And unlike a lease, you don't get to trade up to a new model every few years. You get whatever the vendor decides to build next.

 

With a system in your own Microsoft 365 environment, the structure, the workflows, and every record stay with the company, whoever maintains it.

 

Changes on your timeline, not the vendor's

 

The second difference shows up the first time your program changes: a new client requirement, a revised inspection form, a lesson from an incident that needs to reach the field this week.

 

On a vendor platform, customization usually means a support ticket or a feature request. You end up telling employees and management that the change is coming, and it arrives months later, or never. In a system built in your own Microsoft 365 environment, a new form field, a workflow step, or a new report can often be in place the same day, made by someone who knows your operation.

 

A word on quick-build apps

 

AI tools now make it possible for almost anyone to build a working app over a weekend, and some of those apps are genuinely good. We appreciate the enthusiasm, and a quick prototype can be a useful way to figure out what your team actually needs.

 

But an HSE system isn't a weekend project. It holds injury records, medical information, investigation findings, and training histories, and it has to hold up to an audit. A quickly built app can solve one visible problem while creating quieter ones: records stored in a personal account or an unsecured file, permissions nobody reviewed, no trail of who changed what, and no plan for retention or for what happens when the builder moves on. That puts you right back where you started, with important data you can't fully trust or control.

 

Before you rely on any app for HSE records, ask four questions: Where is the data stored? Who can see it? Can we tell who changed a record, and when? Who supports it next year? For a system this important, it pays to have it built by an experienced professional who designs for security, privacy, and auditability from the start.

 

Where Microsoft 365 is not the best fit

 

Building in Microsoft 365 is a strong option, not a universal answer. Consider a purpose-built EHS platform if:

 

• You need specialized modules at scale, such as large chemical inventories with SDS management, industrial hygiene sampling programs, or complex multi-agency environmental reporting.
• You have no one to own the system and no partner to support it. A Microsoft 365 HSE system needs an administrator, internal or external, like any business system.
• Your clients or corporate parent require a specific platform.

 

The right answer depends on your size, your work, and who will maintain it.

 

Five questions to answer before you build

 

1. Which Microsoft 365 plan do we have, and what security and retention features does it include?
2. Who will own and administer the system after it is built?
3. What records do we need to keep, and for how long, under the regulations and client requirements that apply to us?
4. Who needs access, including contractors and clients, and to what?
5. What do clients and auditors actually ask us for, so the system can produce it in minutes instead of days?

 

If you can answer those five clearly, you are ready to design. If not, start there.

 

HSE Alliance Group designs and builds HSE management systems on Microsoft 365, from document control to field forms and dashboards. Talk with us about your program.

 

 

Sources

1. Microsoft Trust Center, "Microsoft Data Management." https://www.microsoft.com/trust-center/privacy/data-management
2. Microsoft Learn, "Shared responsibility in the cloud." https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
3. Microsoft Learn, "What is Conditional Access?" https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
4. Microsoft Learn, "Overview of version history limits for document libraries and OneDrive." https://learn.microsoft.com/en-us/SharePoint/document-library-version-history-limits
5. Microsoft Learn, "Publish retention labels and apply them in apps." https://learn.microsoft.com/en-us/purview/create-apply-retention-labels
6. U.S. Department of Labor, OSHA, 29 CFR 1904.33, "Retention and updating." https://www.osha.gov/laws-regs/regulations/standardnumber/1904/1904.33
7. Microsoft Learn, "Power Apps and Power Automate licensing FAQs." https://learn.microsoft.com/en-us/power-platform/admin/powerapps-flow-licensing-faq
8. Microsoft Learn, "How to check license designation for an app." https://learn.microsoft.com/en-us/power-apps/maker/canvas-apps/license-designation
9. ISO, "ISO 45001:2018 Occupational health and safety management systems." https://www.iso.org/standard/63787.html