Who still has the keys?
Every tenant accumulates. People leave, projects end, a vendor gets access for a week and keeps it for years. We read the whole tenant, name what is still open, and hand you the list.
- People
- Apps
- Sharing
- Admins
Nothing here is exotic. That's the point.
Microsoft 365 does not clean itself up, and almost none of this shows on a screen anyone looks at. An account that was supposed to be closed in March is still licensed and still signing in. A forwarding rule set up years ago is still copying mail to an address nobody recognises. An app somebody approved once still has permission to read a mailbox.
None of it is a breach. It is the ground a breach stands on, and after something goes wrong, an insurer's questionnaire starts here. We look at it deliberately, once, and write it down.
Five questions, answered with evidence
- 01
The people who left
We take your list of departures and check each one against what the tenant actually did, rather than what the offboarding checklist says was done. Accounts still enabled, licenses still billing, sign-in sessions never revoked, phones still registered as a second factor, mailboxes still delegated to someone, files still owned by a person who is gone.
- 02
Privileged access
Who holds administrative rights, how they got them, when they last used them, and whether the account belongs to a person or to something left behind by a project. Standing admin rights on an account nobody can name is the finding we see most often, and the easiest to fix.
- 03
Everything still tied to an old account
Forwarding and inbox rules, shared mailbox and calendar permissions, distribution list memberships, guest accounts from a vendor engagement that ended, and the applications somebody consented to that still hold permission to read mail or files. Each one is traced back to who set it up and when, where the record allows.
- 04
The critical work left undone
Multi-factor gaps, older sign-in methods still accepted, the settings that stop criminals sending mail as your company, retention and deletion behaviour, and prior recommendations that were agreed to and never finished. We check the tenant, not the meeting notes.
- 05
The audit record, read properly
Microsoft keeps a detailed record of what happened in your tenant, and most of it expires unread. We query it directly, going back roughly six months rather than the week most consoles show, for the events that matter: bulk downloads, mass deletions, sharing switched on, rules created, mailboxes opened by somebody other than their owner.
Start with the people who recently left
The fastest and most useful hour of the whole review.
If you want a smaller starting point, name your recent departures and we will run only that. For each person we reconstruct their last weeks from the tenant's own record: what they downloaded, what they shared outward, what they deleted, what they forwarded, what they still hold today, and what is still costing you a monthly license.
It answers two very different questions at once. The hygiene one, what is still open and needs closing. And the evidence one, whether anything happened on the way out the door that you would want to know about. Most of the time the answer to the second is that nothing turned up, and we say so in writing with the scope and the confidence stated. That is a statement about how hard we looked and where, not a guarantee about what did or did not happen, and we are careful to write it that way.
It is also a question with a deadline on it. The record either shows something or it does not, and it stops being available once Microsoft's retention window closes behind it.
What that actually looks like
The website contact form, set up years ago by someone who has since left, still sends its alerts to their mailbox. Two real enquiries arrived after their last day and sat there unanswered, and nobody knew there was anything to answer.
The domain, the alarm monitoring and the shipping account are all registered to a person rather than the company, so the renewal reminder goes to a closed mailbox and bounces. The first anyone hears about it is the morning something stops working. A shared account's security code still goes to a personal cell that walked out the door, which means resetting the password now involves calling somebody who no longer works for you and asking a favour. A forwarding rule from an old project, set up for a legitimate reason during a busy month and never removed, has been quietly copying a slice of your correspondence to an outside address ever since.
And sometimes their files were the only copy. The pricing sheet, the customer history, the half-finished proposal, all in one person's own storage rather than anywhere shared, and closing the account starts a countdown on all of it. Meanwhile the license never stopped billing: nobody told Microsoft they left, so the seat renews every month, and the account it belongs to can still sign in from anywhere.
Composite examples, drawn from the kinds of finding this review turns up. We don't publish what we find in anyone's tenant.
The review reads. Changing things waits for your say-so.
The review is read-only by design. The tooling we use for it cannot disable an account, end a session, delete a rule or withdraw an application's access, deliberately, so a review can never be the thing that breaks a workday. Anything that needs changing lands on a remediation list you approve item by item.
We connect to your tenant with your consent, through Microsoft's own approval screen, and you can withdraw that access yourself at any time without calling us.
The scope and the price are fixed in writing before anything is examined. What you get back is a plain-English report an owner can read, a prioritised list of what to close and in what order, and the underlying evidence attached for your insurer, your auditor or your attorney if any of them ask.
You do not have to be a managed client to have one done, and the findings are yours to keep and to hand to whoever you like, including your current provider.
When the suspicion is about a person
This page is housekeeping done seriously. If instead you suspect an altered document or a redirected payment, that is a different and deliberately discreet piece of work, run under the direction of you and your attorney. Read how that one works.
Find out what's still open
Bring us the names of who left in the last year. We will tell you what is still theirs, what still costs you money, and what needs closing first.