Microsoft 365 can become the center of the business almost accidentally.
Email moves there.
Then files.
Then Teams.
Then shared mailboxes, OneDrive, guest access, SharePoint sites, forms, and applications connected to Microsoft identities.
Several years later, someone asks:
Who can access this folder?
The answer takes an hour.
Growth creates permission sprawl
The problem is rarely one bad setting.
It is accumulation.
Examples:
- former employees still own Teams;
- external guests remain active;
- shared links are still valid;
- groups overlap;
- employees change departments without old access being removed;
- administrator roles were granted for convenience;
- shared mailboxes have unclear ownership;
- file permissions were inherited from an old migration.
Each item can be reasonable when created.
Together they become hard to understand.
Start with identity
Review:
- active users;
- disabled users;
- guest users;
- administrator accounts;
- shared accounts;
- service accounts;
- licensing.
Identity is the foundation for everything else.
If accounts are unclear, permissions will be unclear.
Map collaboration ownership
For Teams and SharePoint, ask:
- who owns the workspace;
- which department uses it;
- whether guests belong there;
- whether the site is still active;
- what information belongs elsewhere.
A collaboration space should have a business owner, not merely a technical owner.
Reduce one-off permissions
One-off permissions are difficult to maintain.
Where practical, access should follow understandable groups and roles.
For example:
Accounting team
is easier to maintain than twelve individual employees with slightly different rights.
The goal is not creating a giant security project.
It is making future changes predictable.
Review external sharing
External collaboration is valuable.
It should also be intentional.
Check:
- which guests remain active;
- anonymous links;
- site sharing settings;
- expiration policies;
- sensitive document locations.
The right policy depends on how the business works.
A law firm, distributor, membership organization, and multi-location retailer will not necessarily need the same external-sharing model.
Administrator access should be boring
Administrator rights should not be the easiest way to solve every support issue.
Use separate admin accounts where appropriate, limit privileges, enable MFA, and document who has access.
The goal is being able to answer:
Who can materially change this environment?
without opening three spreadsheets.
Ownership matters more than tooling
Microsoft provides extensive administration and reporting capabilities.
The harder question is who in the business is responsible for maintaining the model as people and roles change.
Technology cannot compensate for unclear ownership forever.
Loginect’s Infrastructure & Business IT work can include Microsoft 365 cleanup, access review, migration, configuration, and an operating model that stays understandable after the project is complete.