An employee leaves, a software supplier changes or a service is no longer used. Work continues, but who checks what happened to the access they were given? Can someone still open a shared mailbox, reach documents or use an automated connection?
In Microsoft 365, responsibility for data does not end when an account is created. Permissions accumulate over time: an employee covers for a manager on leave, a supplier connects a new system, and an application receives access to perform a task. Each decision may have been justified at the time. The question is whether it still fits the business today.
Every access arrangement needs an owner
A business owner does not need to remember every technical setting. They do need someone who can explain who has access, to which information, for what purpose, and who is authorized to approve a change.
Keep a clear inventory of administrative accounts, access to shared mailboxes and folders, and applications connected to the environment. Each significant access arrangement should have an accountable owner and a business purpose. Temporary permissions should also have a review date.
This kind of inventory helps with everyday work as well. When a supplier changes or an employee is unavailable, it becomes easier to identify who owns a system and what needs to be handed over. The business becomes less dependent on one person's memory.
An employee's account may be connected to processes the organization needs to continue: handling inquiries, shared documents, meetings or access to a business application. Ending access and maintaining operations therefore need to be planned together.
Before the employee leaves, responsibility for their information and tasks is reassigned. The IT specialist checks the relevant permissions and connections and makes changes under the appropriate policy and authorization. The final checks confirm that the former employee no longer has access and that the remaining staff can do their work.
A similar process is useful when someone changes roles. Access needed in a previous department may not be necessary in the new role.
Software can hold a key too
A backup system, management tool or business application may have permission to access cloud data. Some applications act on behalf of a user; others can use their own identity without a signed-in user. Reviewing the employee list alone is therefore not enough.
When a product is retired, its Microsoft 365 connection also needs review. Who owns it? What permissions were granted? Does another service still depend on it? A familiar name does not prove that access is needed, and a brief period without activity does not prove that it can safely be removed.
Permissions should be reduced only after dependencies have been checked, with documentation and verification that the necessary systems still work.
If your IT specialist changed tomorrow, could you show the replacement a clear picture of who accesses your data and why? If not, a focused access review is a useful starting point. Suntech can help review identities and permissions so that each significant access arrangement is tied to a business need and an accountable person.