Start with the people, not the tools
You do not need to know every tool to start. Write the staff list with five fields only: name, work email, start date, leave date and manager. Then ask each app you pay for for its user list and compare, starting with who has left and still appears in an app.
- Name, work email, start date, leave date, manager.
- One user export per app, run by you.
- Compare by work email.
Ask for a read-only view, not an admin login
A review of your accounts can be done without handing over an administrator login. Microsoft describes its Global Reader role as able to read everything a Global Administrator can, but not update anything, so read-only still shows a lot and an export you run yourself is the tighter way. Remove any role you create when the review is finished.
- Reports Reader has no access to the Exchange admin center, so mailbox and forward lists come from an export you run.
Know what your licence can do
Microsoft's licensing page, checked on 12 October 2026, says Business Premium includes Entra ID P1 and that access reviews and Lifecycle Workflows need an Entra ID Governance subscription. So a small tenant on Business Premium will often be doing leaver checks by hand. Check your own plan before deciding.
Put every renewal on one calendar
Domains, certificates, software and warranties each have their own renewal date, and the reminder often goes to whoever set the item up. Put each one on one calendar with an owner and a backup who are both still at the company, and send a test reminder to both. A reminder nobody confirms is not a control.
Which paid job fits
A written runbook tested on a dummy account fits if you are asked what your leaver process is. The leavers check fits if you suspect someone still has access, and the renewals calendar fits if something has lapsed. The IT hygiene lane repeats the leavers check and the renewals calendar every month, the runbook is a separate job, your own admin makes every change, and nothing is promised about response times.
Sources and limits
- Hacker News: On-boarding and off-boarding workflow Checked 2026-10-12.
- An Ask HN post of 30 August 2022 on this topic drew replies naming Confluence pages, BetterCloud or Okta Workflows, and a shared spreadsheet with owners and due dates counted from the start date.
- Microsoft Learn: Microsoft Entra licensing Checked 2026-10-12.
- The page (checked 12 October 2026; it shows 'Last updated on 2026-06-18') says Microsoft Entra ID P1 is included in Microsoft 365 Business Premium, and that Entra ID P2 is included in the Microsoft Defender Suite add-ons for Business Premium.
- It says using access reviews requires a Microsoft Entra ID Governance subscription for member users, including everyone reviewing or being reviewed, and that some capabilities might operate with Entra ID P2.
- Its example scenarios count licences for both reviewers and reviewed users, for instance 75 member users plus 1 group owner as reviewer needing 76 licences.
- It says Lifecycle Workflows require a Microsoft Entra ID Governance subscription, and its feature table lists Lifecycle Workflows under Entra ID Governance and the Entra Suite but not under P1 or P2.
- Microsoft Learn: Microsoft Entra built-in roles Checked 2026-10-12.
- Global Reader is described as able to read everything that a Global Administrator can, but not update anything.
- Reports Reader is described as able to read sign-in and audit reports, and Security Reader as able to read security information and reports in Microsoft Entra ID and Office 365. The Reports Reader text adds that holders have no admin permissions to configure settings or to access product-specific admin centers like Exchange.
- On the roles table, Global Reader and Security Reader carry the privileged-role label and Reports Reader does not.