Practical guide · Access
Access that is useful today can become silent debt tomorrow.
Un accès utile aujourd’hui peut devenir une dette silencieuse demain.
lire cette page en françaisAccess hygiene means regularly checking why an account, guest, group, or role still exists—and having the right person confirm what happens next.
The decision to make
This guide separates recurring access maintenance from everyday user requests and deeper security assessment.
Start with the business reason
An account list is not enough. External and privileged access should have a reason, owner, and understandable duration. Without those three facts, a technical administrator cannot honestly decide whether to keep or remove it.
Guests and shared spaces
Guests often arrive for a project, client, or supplier. A useful review connects the guest to the workspace and the business person who can confirm the collaboration is active.
- Confirm the workspace owner
- Identify guests without known activity or context
- Record the decision to retain, limit, or remove
Administrative roles
A privileged role should correspond to a real responsibility. Recurring care can identify holders, duplication, and accounts without clear justification; complete security architecture or investigation remains a separate engagement.
Departures, role changes, and inactive accounts
Good hygiene depends on information moving between HR, managers, and M365 administration. A departure checklist covers account blocking, required retention, responsibility transfer, and connected devices or services.
A simple matrix for assigning the work.
| Situation | Owner | Cadence | Useful evidence |
|---|---|---|---|
| User account | Manager + HR | Join, change, leave | State and transfer |
| External guest | Collaboration owner | Periodic review | Reason and decision |
| Administrative role | M365 owner | Agreed review | Role justification |
Decision checklist
What should be true before considering this area under control.
- Every guest has a business owner
- Administrative roles have a justification
- Departures trigger a checklist
- Inactive accounts are reviewed
- Deeper anomalies move to a separate security review
Next step
Turn access review into a next action, not a forgotten inventory.
The readiness planner creates a local list you can copy. Then review the service scope to see what belongs in monthly care.