SharePoint intranet analytics for government: what the built-in statistics miss

Does SharePoint not have its own statistics? It does. Almost every SharePoint Online environment has built-in usage reports available in the admin centre. They show how many page views a site has received, how many unique visitors, and which files have been opened.

But there are two problems. The first is an access problem. The second is a privacy problem. Together they make the built-in SharePoint statistics unusable for most public sector organisations for the purpose they are actually needed.

What the built-in SharePoint statistics actually measure

Before looking at where they fall short, it helps to know what SharePoint Online records out of the box. Every modern site has a Site Usage page, and individual pages have their own analytics.

At site level you get unique viewers, total visits, average time spent per user, the most popular content, activity by device, and the days and times with the most traffic. At page level you can see views, unique viewers, average time spent and traffic over time for a specific news item or article. Separately, Microsoft Search usage reports show what people search for across the tenant, including queries that returned no results — useful for spotting content gaps.

Two limits matter. The site usage report only looks back 7, 30 or 90 days; extending page analytics to a full year requires a Microsoft Viva license. And there is no consolidated view across sites: each report is scoped to a single site, so an editor managing several areas cannot see the whole intranet in one place.

Who has access?

There is an important distinction here. Site owners can see the usage report for their own site, and page authors can see analytics for their own pages. But the organisation-wide usage reports — the ones that give a picture across the whole intranet — sit inside the Microsoft 365 admin centre and require an administrator role: global administrator, SharePoint administrator, or reports reader.

Those broader reports are not available to the people who create intranet content. The communications adviser who wants to know whether the news item about the reorganisation was read across the organisation does not have those rights. The intranet editor wondering whether the new policy page is reaching the right department cannot get a cross-site answer either. They depend on the IT department for an export, and that export is rarely urgent enough to land quickly.

In practice, this means intranet editors at most public sector organisations work with no insight into usage. They guess based on reactions in the hallway.

The privacy problem

The second problem is subtler than it looks. Your organisation already uses SharePoint Online, which means Microsoft already processes the content, access logs, and authentication data as part of delivering the service. There is a data processing agreement for that. That is not the problem.

The problem arises the moment you start actively using the statistics for editorial decisions. Because at that point you are using the same data for a new purpose: analysing employee behaviour. That requires its own legal basis, separate from the existing data processing agreement.

In concrete terms, that means three things most organisations have not arranged.

• Works council approval. In the Netherlands, the Works Councils Act (WOR art. 27) requires the works council’s consent for systems that can monitor employee behaviour or performance. SharePoint statistics at individual level fall under this, even if monitoring is not the intention.
• DPIA. Using personal data of employees for a new processing purpose requires a data protection impact assessment. The standard Microsoft DPIA does not cover this.
• Data minimisation. For the purpose you actually have, knowing which content works, you do not need individual data. Which pages are being read is an aggregated question. Who read them is not. Collecting individual data when aggregated data suffices is contrary to the data minimisation principle under the GDPR.

The statistics were simply there, as part of the Microsoft 365 licence. No active choice was made to record employee behaviour. But the moment you use them, you have made that choice.

Your intranet data does not belong at Microsoft

There is a third problem, less visible but equally relevant for public sector organisations.

Microsoft is an American company. The Cloud Act gives the US government the authority to request data from American companies, even when that data is physically stored in Europe. Microsoft has data centres in the Netherlands and offers “EU Data Boundary” options, but those do not fully eliminate the Cloud Act risk. The legal ownership structure remains American.

For a municipality tracking which employees visit which intranet pages, with that data stored in Microsoft infrastructure, this means the information can in principle fall outside Dutch jurisdiction. For most public sector organisations, that is an unacceptable risk, however abstract it may seem.

The question information managers and CISOs should ask themselves: do we want the behaviour of our employees on our intranet to be available in a system over which we ultimately have no full control?

What an intranet editor actually needs

The answer to the statistics question is not: do not use them. The answer is: use an intranet analytics tool that measures what you want to know, without the privacy problems the built-in SharePoint statistics bring.

What an intranet editor or communications adviser actually needs is concrete:

• Page visits per intranet page, broken down by period
• Insight into which departments are most active on the intranet
• Comparison of reach between news items, policy documents, and practical information
• Trends over longer periods, not limited to 90 days

What is not needed: knowing exactly who viewed what. Aggregated patterns are enough to make good intranet editorial decisions.

How the govanalytics SharePoint Tracker solves this

The govanalytics SharePoint Tracker measures intranet usage in aggregate, without linking to individual employees or Microsoft 365 accounts. By default, no personal data is processed: no name, no email address, no Azure AD identifier.

It is possible to pass contextual dimensions such as department or location. That is also the recommended approach: measuring at department level gives intranet editors actionable insight (“the Communications department is considerably more active than Finance”), without that data being traceable to an individual employee. The department is then a property of the visit, not of the person. As long as the data is not combined with an identifier that leads to an individual, the measurement stays aggregated and outside the scope of the works council obligations that the built-in SharePoint statistics do trigger.

Data is stored on Netherlands-based servers, under Dutch jurisdiction. No Microsoft infrastructure, no Cloud Act risk. Your intranet usage stays within your own organisation.

The dashboard is accessible to intranet editors and communications advisers, without requiring administrator rights. The IT department does not need to be involved for every report.

The tracker works with both SharePoint Online and SharePoint Subscription Edition (On-Premises), via a JavaScript snippet or a SharePoint extension.

In addition to the govanalytics platform, the SharePoint Tracker also supports Piwik PRO and Matomo. All three variants are GDPR-compliant and suitable for Dutch public sector organisations.

Asking questions of your intranet data

The govanalytics platform has an Ask AI interface that lets you ask questions about your analytics data in plain language. This is not a technical addition: it is the way intranet editors without a data background can independently get answers to the questions that matter to them.

Practical examples for intranet managers and editors:

• “Which department is most active on our intranet this month?”
• “Which pages have been read least in the past 30 days?”
• “How did the reach of the news item about the new collective agreement develop in the first week?”
• “Which content attracts the most visitors from the Utrecht office?”

The agent only has access to your own environment’s data, reads that data only, and cannot modify or export anything. Which language model runs underneath is a setting you control, so the data does not leave your own infrastructure if that is a requirement.

Is CardioLog Analytics an alternative?

For organisations already working with CardioLog Analytics or considering it, a direct comparison is available. CardioLog is a specialist intranet analytics tool with a long history in SharePoint environments, but differs from the govanalytics approach in several areas, particularly on hosting, privacy, and cost.

Frequently asked questions

Does SharePoint have built-in analytics?

Yes. Every SharePoint Online site includes site-level usage reports and per-page analytics showing unique viewers, visits and average time spent. The scope and retention are limited, and there is no consolidated cross-site view for editors.

How far back does SharePoint usage data go?

The site usage report covers the last 7, 30 or 90 days by default. Extending page analytics to about 12 months (365 days) requires a Microsoft Viva license.

Can intranet editors see SharePoint analytics without admin rights?

Site owners can view usage for their own site. Organisation-wide reports in the Microsoft 365 admin centre require an administrator role. A communications adviser without site-owner rights, or anyone needing a cross-site or long-term view, still depends on IT.

Is using SharePoint usage statistics GDPR-compliant?

The statistics are part of your Microsoft 365 service. The issue arises when they are used at individual level for a new purpose — analysing employee behaviour — which needs its own legal basis, a DPIA and, in the Netherlands, works council consent. Measuring in aggregate avoids this.

Where is SharePoint intranet usage data stored?

In Microsoft's infrastructure. Even with EU Data Boundary options, Microsoft remains a US company subject to the Cloud Act, so full jurisdictional control is not guaranteed — a key consideration for public sector organisations.