Job it-stale-and-over-privileged-accounts-report-microsoft-365-or-google-workspace · revised 12 October 2026
See stale accounts, admins and missing MFA across Microsoft 365 or Google Workspace
One report for your Microsoft 365 or Google Workspace account: no recent sign-in, no MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, each with its evidence row.
You might be seeing
- The admin role list has grown and nobody reviews it
- Old accounts, guests and forwards remain long after the reason for them has gone
No passwords, keys, card details or admin invites needed to start.
What usually happened
A tenant collects accounts, admin roles, guests and mail forwards over the years. The console shows each one separately, and the built-in access review tools need licences that small tenants often do not have.
Who it’s for: IT lead or owner of a 10 to 250 person tenant, before a customer security review, insurer renewal or Cyber Essentials.
Usually starts when: Someone asked who has admin rights or who is not on MFA, and nobody could answer from the console in under an hour.
The result: You receive one report on your tenant (your company's Microsoft 365 or Google Workspace setup) listing accounts with no sign-in for the days you choose, accounts without MFA, every admin role holder, guests, and shared mailboxes and forwards with no owner. Each finding has its evidence row and a decision column for you. Nothing is changed.
Check whether this job fits
Answer these without sending files, logins or personal data. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
List your administrators
In the admin console, open the list of users with an admin role and count them.
Look for: Names you do not recognise, or more admins than the business needs. The report ranks these for you.
What you get
- The ranked findings report
- The export reference for each finding
- Console steps for your admin
- The seeded test result
Included
- One tenant of 10 to 250 people
- Account-level data only: sign-in dates, MFA status, roles, guests, shared mailboxes and forwarding rules
- Read-only exports you run, or a read-only role you create and remove afterwards
- Ranked findings with a decision column and the console steps for your admin
- A smoke test on a synthetic tenant export with 25 issues your admin plants and keeps from us until the test run
Not included
- Disabling accounts or changing roles
- Mailbox or file contents
- Incident response for a suspected break-in
- Conditional access design
- Licence purchases
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On a synthetic tenant export with 25 issues your admin plants across stale, no-MFA, admin, guest and forward cases and keeps from us until the test run, at least 23 are found and no clean account is listed; listing a clean account fails the whole test.
Evidence: The planted list beside the report.
The admin role holders in the real report match your console list line for line.
Evidence: The console list and the report table.
Every finding points to an export row, and your admin confirms a 20% sample, at least 10, against the live console with no false finding.
Evidence: Your marked sample.
The role you created could not change anything, and no setting in the tenant was changed by us.
Evidence: Your audit log for the run window.
Sign-off. Your admin checks the sample and signs off in writing. The 25-issue test is a smoke test, not a measured rate: 23 of 25 shows only that the true find rate is at least 76% at 95% confidence. Payment follows sign-off.
If it fails. If a test is not met, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- You run the exports yourself, or create a read-only role that can see every item on the list (we confirm the role with you before you create it)
- Sign-in data is used at account level only
- A named admin confirms a sample against the live console
We stop and tell you if
- You want us to disable accounts or change roles
- You suspect the tenant is already compromised
- You will not create a read-only role or run exports
What could go wrong
This job reads files you send and writes a report. It changes nothing in your systems, so there is nothing to revert. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| An account is wrongly called stale and then disabled, stopping real work. | Findings are questions with the evidence row, nothing is changed by us and your admin confirms before acting. |
| Sign-in data reveals patterns of when a person works. | We use last sign-in date at account level, not locations or times, and keep nothing after hand-over. |
| A shared mailbox or forward with a good reason is called a problem. | The finding asks who owns it. It does not say it should be removed. |
A separate automated reviewer checks every output against the agreed test before hand-over. No person on our side reviews unless your agreement names one. Your named IT admin approves what is used.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the platform, stale-day rule, approved admin list and export route
- Your admin plants 25 issues in a synthetic export we have not seen
- Run the checks on the synthetic export, then yours, and rank findings
- Attach the export row to every finding and add a decision column
- Separate automated review of each finding against its row
- Hand over the report and console steps; remove the role afterwards
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept, and an enquiry creates no charge or booking. Work starts only after agreed inputs, secure access and any needed permissions are in place.
Need to keep it working?
Discuss a monthly review that repeats this report.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Microsoft access reviews need an Entra ID Governance subscription, and Microsoft 365 Business Premium includes Entra ID P1 only, unless the Defender Suite add-on is bought, which adds P2. learn.microsoft.com
- Your admin console can list inactive users and admins by hand. It is free and slow for a tenant of any size.
Questions
Do you need admin access to the tenant?
No. A read-only role that you create, or exports you run. You remove the role afterwards.
Will you turn on MFA or remove admins?
No. We list them with evidence. Your admin decides and acts.
Does this replace Microsoft's access reviews?
No. It is a report from exports for tenants without those licences. It is not an audit and gives no assurance.
Send an enquiry
Send us
- Whether you use Microsoft 365 or Google Workspace, and your licence tier
- Roughly how many accounts, guests and shared mailboxes you have
- The number of days without sign-in that counts as stale
Later, once you agree
- Exports from the admin console that you run, or a read-only role you create
- Your stale-account rule and your list of approved admins
- A named admin who checks a sample against the live console and plants 25 issues in a synthetic export, keeping the list from us until the test run
- The agreement that names the model provider, its country and how long it keeps data, settled before any real personal data is shared
You keep every admin right and create and remove any read-only role. In Microsoft, Reports Reader reads sign-in and audit reports but not Exchange, so shared mailbox and forwarding lists come from an export your admin runs in the Exchange admin centre, or from a read-only Exchange role group such as View-Only Organization Management that we confirm with you first. Global Reader reads far more and is marked privileged, and we work at account level and never read mailbox or file contents.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-stale-and-over-privileged-accounts-report-microsoft-365-or-google-workspace” as the subject.