Who can still get into your Microsoft 365 environment?

Third Level IT · IT field notes

Begin with account ownership

Ask for a current list of users and administrative roles, with an owner for every account. Distinguish daily work accounts from administrative accounts and emergency access. An unfamiliar display name is a reason to investigate, not proof that an account should be removed.

Review authentication coverage

Ask which accounts are covered by the organization’s authentication policies and which are exceptions. Check the effective policy and recent evidence, rather than treating an enrollment screen as proof that every sign-in is protected. Any change to emergency access needs a recovery plan before implementation.

Look beyond employees

Former providers, guest users and applications may have access independently of your employee roster. Review delegated administration, application permissions and service principals with a named business purpose. An application with broad access can remain important after the person who configured it leaves.

Trace offboarding across systems

Disabling a user account is one action in a wider process. Establish how the organization handles active access, shared information, device ownership and business records. Follow the company’s retention and legal requirements before deleting data. Coordinate access changes with the people responsible for business continuity.

Ask for evidence and exceptions

The review should record what was checked, which accounts or applications could not be attributed, and the next action for each gap. Useful evidence identifies the time of the observation and the affected object without circulating credentials or unnecessary personal information.

Avoid blanket changes

Removing an application or changing a tenant-wide policy can interrupt legitimate work. Scope remediation around the confirmed finding, identify dependencies, preserve the relevant configuration and verify the result. Product licensing and configuration affect which controls are available; determine those before prescribing a setting.

Turn the review into a repeatable process

Define who approves new access, who reviews exceptions and what happens when a staff member or provider leaves. Repeat the review after a provider transition or a major organizational change. The goal is an accountable access process, not simply a one-time list of accounts.