A person leaves the company, a project ends, an external collaboration comes to an end. The associated access sometimes remains longer than necessary without a clear process.
Start with an important filing
You don’t have to check all systems at the same time. Choose an area with important company information and appoint a person with technical responsibility. This can assess who needs the data for their work.
The technical view alone is often not enough. A group can have a plausible name and still contain former project members. The test should therefore combine technical and professional perspectives.
Ask the right questions
- Which people and groups can see the content?
- Who can change content or give new approvals?
- Which external guests are also involved?
- Which accounts are used for administrative tasks?
- Who will check the list the next time there is a personnel or project change?
Devices are included
An authorized account is only part of access. It is also important which devices are used and how they are managed. Microsoft describes protecting and managing devices as part of the security strategy in the Business Premium documentation.
Therefore, check how new devices are set up and how lost or retired devices are handled. Record who carries out the relevant steps and how they are documented.
Make the exam a process
The first cleanup helps. It only becomes sustainable through a repeatable process. Connect access checking to events that are already happening: entry, role change, exit, and project closure. This means no one has to think about an additional special test.
A short handover protocol can already record which accounts have been changed and who answers open questions. A regular appointment is also useful for particularly important files.
The most important question is not only “Who can access?”, but also “Who decides whether this access is still necessary?”
Irontec supports you Identities, devices and IT security as well as supporting your Microsoft-365 environment.
