People and IT housekeeping in order: six checks from the handbook to the last renewal

How to use this order

Take the six checks in order and stop at the first one that fails. Every check works from files or exports you run yourself, read-only, and none needs an admin login handed to anyone. This is an authored review sequence, not a vendor procedure, and it does not claim to cover everything a business should check.

Checks one to three: the handbook, the answers, the starter list

Check 1 asks whether the handbook agrees with itself: search every number, date and job title for two different values. Check 2 asks whether a staff question can be answered by quoting one section: take ten real questions, and write down which should go to a person.

Check 3 asks whether a manager can follow a starter checklist for an invented starter without help. Use a dummy person, never a real one. The New York City business chatbot, whose answers on tips, schedule notice and cash The Markup found wrong on 29 March 2024, shows what an assistant does when it answers from memory.

• 1: no number, date or role appears with two values.
• 2: each question has one quoted section, or a named person.
• 3: a dummy starter produces every task with an owner and a date.

Checks four to six: leavers, accounts and renewals

Check 4 asks who has left but still has an account: compare a staff list of five fields (name, work email, start date, leave date and manager) with the user export from your directory and each app, matching on work email. Check 5 asks who has admin rights, no recent sign-in or no MFA: use exports you run, or a read-only role; Reports Reader has no access to the Exchange admin center, so shared-mailbox and forward lists need an export. Microsoft describes Global Reader as able to read everything a Global Administrator can but not update anything, and Google's Reports API has two read-only scopes.

Read-only is not the same as narrow, because a role shows whatever it is allowed to see, so exports you run yourself are the tighter route. Check 6 asks what renews in the next 90 days and who gets the reminder: put each renewal on one calendar with an owner and a backup, send a test reminder to both and ask them to confirm.

• 4: every leaver with an active account is listed with the export row.
• 5: every admin is named and approved, or listed for a decision.
• 6: every renewal in 90 days has an owner, a backup and a confirmed reminder.

Why the built-in tools may be missing

Microsoft's licensing page, checked on 12 October 2026, says access reviews and Lifecycle Workflows need an Entra ID Governance subscription, that some access review capabilities might work with Entra ID P2, and that Business Premium includes Entra ID P1. If your tenant has none of these, the checks above done from exports are the manual route. Check your own tenant before relying on this, because licensing pages change.

What to buy, if anything

Start with the contradictions report, then the cited-answers assistant tested on your own questions, then the task pack for the starter list. For leavers and accounts use the leavers check and the tenant accounts report, then the monthly versions; for renewals, the renewals calendar. The lanes bundle the monthly versions with one bounded extra item a month, every output is a list or draft for your named person, and your admin makes every change.