This article was written with the help of AI. We used an AI assistant to draft it, then checked the steps against Microsoft's documentation. Sources are linked throughout.
A Microsoft 365 access review is the simplest security work most small businesses skip. Once a year, go through every account and role and ask one question: does this person still need this? Year-end is a good time, because staff changes, contractors and projects from the past twelve months are still fresh in everyone's mind.
Every account you remove is one an attacker cannot phish, and one fewer to check if something goes wrong. Our least privilege access review guide covers the general idea; this post is the Microsoft 365 checklist.
1. Guest Accounts
Every time someone shares a file or invites an outside person to a Team, Microsoft 365 can create a guest account. Microsoft notes that these become stale when collaboration ends and the person stops signing in.
- In the Microsoft Entra admin center, open Users and filter by user type Guest.
- Add the last sign-in column and sort. Guests who have not signed in for months are the first to go.
- For each remaining guest, ask whoever invited them whether the work is still going on.
If you have Microsoft Entra ID Governance or Entra Suite licenses, Microsoft offers an inactive guest report and automated access reviews that can block and later delete guests who stop signing in. Without those licenses, the manual check above does the same job once a year.
2. People Who Have Left
Compare your list of active Microsoft 365 users against your current staff list. For anyone who has left:
- Block sign-in and sign them out of all sessions.
- Remove them from groups, Teams and shared mailbox permissions.
- Remove their phone and authenticator methods and any devices registered to them.
- Decide what happens to their mailbox and OneDrive files, and who takes ownership.
- Remove the license once the data is handled, so you stop paying for it.
Also look for accounts that were never people: an old scanner login, a vendor's test account, an "info" user created before anyone knew about shared mailboxes.
3. Shared Mailboxes
Shared mailboxes are useful for addresses like info@ or billing@, but they collect permissions over time. Microsoft's guidance is direct: a shared mailbox "isn't intended for direct sign-in," so "always block sign-in for the shared mailbox account and keep it blocked."
- Confirm sign-in is blocked on every shared mailbox account.
- Review who has Full Access, Send As and Send on Behalf, and remove anyone who no longer needs it.
- Check for licenses you do not need. Microsoft says a shared mailbox can hold up to 50 GB without one; larger mailboxes, archiving and litigation hold need a license.
- Delete shared mailboxes nobody reads, after exporting anything you have to keep.
4. Admin Roles
Admin roles are the accounts attackers want most. In the Entra admin center, open Roles and admins and look at who holds Global Administrator, then the other admin roles.
- Remove roles from anyone who only needed them for a one-off task.
- Give people the narrowest role that does the job, such as User Administrator or Exchange Administrator.
- Make sure every admin uses strong, preferably phishing-resistant, MFA.
- Keep a separate emergency access account, as Microsoft recommends, so a policy mistake does not lock everyone out. Check that its credentials are stored safely and still work.
5. Apps and Sign-In Methods
Finish with two quick looks. Under Enterprise applications, check for apps users have granted access to mail or files that nobody recognizes. And check that sign-in methods you do not use, such as the device code flow, are blocked.
Write It Down
Keep a short record: the date, who did the review, what was removed and why. Cyber insurers and auditors often ask for proof of regular access reviews, and next year's review goes faster when you can see what you decided this year. Our cyber insurance checklist lists other controls insurers commonly ask about.
Sources
- Microsoft Learn: Monitor and clean up stale guest accounts
- Microsoft Learn: About shared mailboxes
- Microsoft Learn: Manage emergency access accounts in Microsoft Entra ID
Common questions
How long does a year-end access review take for a small office?
For a business with a few dozen accounts, usually an afternoon. Most of the time goes into asking managers whether a name still needs access, not into the clicks.
Do we need Microsoft Entra ID Governance to do this?
No. Microsoft's automated access reviews and inactive guest report need Entra ID Governance or Entra Suite licenses, but you can do the same review by hand from the Microsoft 365 and Entra admin centers.
Should we delete a former employee's account?
Block sign-in first, then decide. Many businesses convert the mailbox to a shared mailbox so coworkers keep the email, which Microsoft says can hold up to 50 GB without a license. Delete the account only when you are sure nothing else depends on it.
How many Global Administrators should we have?
As few as you can run with, plus a separate emergency access account that Microsoft recommends keeping for lockouts. Day-to-day work should happen in a normal account.
