Stop hand-clicking SharePoint governance: rolling out nav, themes, content types, and term sets in one CSV

The manual rollout work that eats 8 to 12 hours per tenant — navigation, branded themes, content types, term sets — run from a single CSV.

Every SharePoint tenant rollout has the same long tail. Migration finishes in a weekend. Then someone has to:

Build the top navigation on every site collection so users can find anything
Apply the company's branded theme so the new tenant doesn't look like a default install
Create the content types that classify documents (Contract, SOW, Policy, Meeting Notes — whatever your taxonomy needs)
Populate the term store so managed metadata columns actually have values to pick from
Wire content types and term sets together so users get dropdowns instead of free-text

None of that is hard. All of it is tedious. Most consultancies bill 8–12 hours per tenant just for this layer, and the work is mostly clicking through SharePoint Admin Center and writing PowerShell that breaks the moment Microsoft ships a permission change. We built Bulk Provisioning to do all four operations from CSV input, in one workspace, with idempotent re-runs.

The problem with the manual path

Try this experiment. Open SharePoint Admin Center. Time how long it takes to:

Add six top-nav links with parent-child nesting on a single site
Create a tenant theme from a Fluent UI palette (30 colour keys), deploy it, then apply it to four sites
Create three content types under a custom group, each inheriting from the right parent (Document, Item, or Site Page — not just "the default")
Build a term store taxonomy with 5 sets and 25 terms with descriptions

An experienced SharePoint admin will spend roughly two hours, mostly waiting for the admin centre's slow page transitions. The first-time admin will spend a full day, half of it figuring out why their theme didn't apply and why their content type ended up with the wrong parent. Then they'll do it again on the next tenant. Then again. Tenant rollouts that should take a weekend stretch into weeks.

What CSV-driven provisioning looks like

Each section in Bulk Provisioning takes a CSV (or JSON for hierarchical input). The format is documented inline and there's a Download sample button that gives you a working starting CSV with realistic enterprise content you can adapt.

Navigation

Flat CSV with a parent-child reference via stable string IDs:

tempId,title,url,parentTempId
resources,Resources,,
res-supporting,Supporting People,,resources
forms,Forms and Tools,,
forms-hr,HR Forms,/sites/intranet/Forms/HR,forms

Top-level rows have an empty parentTempId. Children reference the parent's tempId — not the SharePoint-assigned node ID, which doesn't exist yet. Cross-site URLs (anything under /sites/ or /teams/ different from the target site) are auto-flagged so SharePoint doesn't reject them with "no such file or folder".

Theme

Paste a 30-key Fluent UI palette JSON, name the theme, list the sites to apply it to, and click Deploy. The tool writes the theme to the tenant catalog (thememanager/UpdateTenantTheme), then walks the sites applying it. If a theme with the same name already exists, it falls back to update — so palette tuning during onboarding doesn't hit duplicate errors.

Content types — with the Hub deploy path

One CSV row per content type:

name,description,group,parentId,columnNames
MigrationFox-Document,"Branded document content type",MigrationFox,0x0101,
MigrationFox-Item,Default item content type,MigrationFox,0x01,
MigrationFox-SitePage,Branded modern page,MigrationFox,0x0101009D1CB255DA76424F860D91F20E6C4118,

parentId picks the inheritance chain — 0x0101 for Document, 0x01 for Item, the long hex for Site Page. Common parents are listed in the helper text so you don't have to look them up.

For tenant-wide rollouts, tick the Deploy to tenant Content Type Hub toggle. The tool auto-fills the URL with https://<tenant>.sharepoint.com/sites/contentTypeHub (the special site collection every M365 tenant has by default). Your CTs land in the Hub. Then in SharePoint, open each CT and click Manage publishing → Publish to fan it out to every site in the tenant. Re-publish to roll out changes.

Term Store — global or site-local

The Term Store tab has a scope toggle: Global (tenant-wide) or Site-level. Global writes go to Microsoft Graph's tenant-wide term store; site-level writes go to the per-site store. CSV format:

groupName,setName,termName,description
MigrationFox,Document Types,Contract,Signed legal agreements with customers and vendors
MigrationFox,Document Types,Statement of Work,Engagement-specific scope and deliverables
MigrationFox,Departments,Engineering,Product engineering and platform reliability
MigrationFox,Categories,Confidential,Sensitive customer and financial records

Existing groups and sets get reused (idempotent); terms always create. For clean re-runs, delete the term set in SharePoint first.

Permissions, honestly

Bulk Provisioning calls real SharePoint admin endpoints. That means the signed-in user needs the right SharePoint role — not just an OAuth scope. The error messages it surfaces are tied to the actual cause:

Theme HTTP 403 — the tool auto-elevates the signed-in user to Site Collection Admin via the tenant admin SetSiteAdmin REST call before each ApplyTheme. That requires the SharePoint Administrator role in Entra ID. Since Microsoft's 2024 RBAC tightening, Global Admin no longer auto-inherits this; assign it explicitly at Entra ID → Roles and administrators → SharePoint Administrator.
Term Store accessDenied — needs both the TermStore.ReadWrite.All Microsoft Graph delegated permission (with admin consent) AND the user being a Term Store Administrator in the SharePoint Admin Center. One without the other still 403s.
Content Types — Site Collection Admin on the target site (or on /sites/contentTypeHub for tenant-wide deploy).

The error text in the tool tells you which of these failed and how to fix it. No "consult your administrator" black box.

Idempotent re-runs are the unlock

The reason CSV-driven provisioning beats clicking through Admin Center isn't speed for the first run — the first run is comparable. The unlock is the second run. Tweaked the colour palette? Re-upload the same CSV; the theme updates. Found a missing content type? Add a row, re-upload; it appends. Need to deploy the same governance package to a second tenant? Same CSV, different credential.

Most manual SharePoint provisioning ends up living in someone's PowerShell script that breaks every six months when Microsoft changes a permission. Bulk Provisioning carries the right endpoint changes forward for you. The thememanager path replaces the legacy composed-look API. The contenttypes Graph endpoint replaces the old SP REST collection POST that silently mis-parented every CT under Item. The term store global scope routes to the right Graph version (beta vs v1.0) depending on whether you want tenant-wide or site-local.

Where it fits in the lifecycle

Bulk Provisioning is the Deploy pillar of the MigrationFox Governance Suite. The full lifecycle:

Audit — six read-only assessments tell you where the tenant is today.
Plan — Restructuring Wizard, OneDrive Cleanup, Migration Rehearsal, Dependency Graph, Modernization Engine produce signable client deliverables for the work that needs to happen.
Deploy — Bulk Provisioning writes the governance back into SharePoint.
Monitor — Continuous Monitoring catches drift over the months after.

Most teams stop after the audit pillar and hand a PDF to the customer. The plan and deploy pillars are what turn a $1,599 audit engagement into a $15,000 governance package. CSV input is what makes the deploy pillar repeatable across tenants instead of a one-off PowerShell tax.

Pricing

Bulk Provisioning is included in the Tenant Suite (CA$1,599 / 1 year / 1 tenant) and Consultant Pro (CA$2,499/year / unlimited tenants for one named consultant). It is not sold individually because the deploy pillar's value comes from re-running it many times during a rollout, not as a one-shot audit.

Ready to skip the manual rollout step? Open Bulk Provisioning →