@MDB_GIS What I've done, and of course there's a few ways to skin a cat and depending on size of your organisation, is the following;
Groups - Each service area or team have two main groups to themselves. One for all team/service members, another Editors' group for key data custodians or creators in that team. This means that a team/service can create and share their own data amongst themselves - especially important where you've got sensitive or operational data that you don't want the organisation to see. As an example, I have 130 Groups, so 65 teams/services setup each in their own space. This AGOL setup is mirrored in the way I did Portal too.
A typical service will see for example "Planning and Built Environment", "Planning and Built Environment (Editors' Group)" as their own.
Every member of the organisation belongs to an Organisation Group where I share all content elements from data to apps etc.. I have a couple of other groups to manage, by default, new members and other app elements.
Folders - as admin I have folders setup and named for likes of Organisational Maps, Instant Apps, Dashboards etc, then for data I have folders for each theme of data eg; environment, iot, flooding, roads, planning etc etc.. Typical folder being called "data - admin boundaries" or if I want to keep certain folders to the top "-=Public Maps and Apps=-"
Org Categories - setup to allow easier searching and part of how I manage our Open Data deployment, however, it's not really something that from a management piece I'm delving into often. I categories setup mirroring what I have for my data folders by theme.
Tags - like above just help with data searches in both the data catalogue and Open Data.
Member Categories - basically mirror the group setup, so a member is in a team/service category
Member Roles - Creators have the ability to share data to the team/service groups they belong to, but not to the organisation ,and not to the public. They also can't create their own groups - in our exploration of AGOL before going enterprise, I allowed this and it quickly got messy. If a service wants a public facing element, then they approach me and we discuss.
Admin account - my admin account owns all data and apps that are published to the Organisation. Sharing is kept as me the owner but shared to the Organisation Group. As I finally have the confidence in Data Custodians to truly look after their own organisational dataset, I will change ownership of that dataset to them, once due processes are in place.
Credits - I limit everyone to 5 credits, even my admin account I limit to 100. Saves having any mishaps where people try to geocode 50,000 address points in one go. Most users that would be looking to do analytics have deployed ArcPro.
Data Interoperability Tool (FME) is your friend - I use it nearly every day to run update processes, report outputs for service areas where they are carrying out inspections, risk matrices, or even just a simple run through of publishing a dataset.
