Four weeks ago a client terminated their MSP contract. Their independent security advisor, me, is still…
Lee F. — IAM & GRC Consultant | Identity Governance, Access Control & Security Design
Four weeks ago a client terminated their MSP contract. Their independent security advisor, me, is still waiting for the handover.
No Microsoft 365 admin access. No firewall credentials. No network documentation. No backup system access.
Just silence.
This is not unusual. It happens more than most business owners realise and it exposes something that rarely gets talked about.
Most organisations do not actually control their own IT environment. Their provider does. The admin accounts, the credentials, the documentation, it all lives with the MSP. When the relationship ends, so does your visibility into your own systems.
The organisation in this case is doing everything right. They terminated properly, they are chasing it up, and they have a new provider ready to go. But they are sitting in a gap right now where nobody has full visibility of what is running, who has access, or whether anything has changed.
This is exactly why access governance and documentation needs to exist independently of whoever manages your IT day to day. Not because your MSP is malicious. Most are not. But because your business should own the picture of its own environment at all times regardless of who is managing it.
If you do not know who holds admin access to your Microsoft 365 tenant right now that is worth finding out before you ever need to ask someone else for it back.
#ITGovernance #Cybersecurity #Microsoft365
9 reactions · 0 comments
Topics: #microsoft365, #cybersecurity, #itgovernance