Standing service it-stale-and-over-privileged-accounts-reviewed-every-month · revised 12 October 2026
Standing service
Review every month which accounts are stale, admin or missing MFA in your tenant
Each month we list accounts with no recent sign-in or MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, from read-only exports, with a decision column.
This starts a conversation by email. Nothing is charged, and nothing is run, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
A tenant drifts month by month: new admins, new guests, new forwards and accounts nobody uses. A one-off report goes out of date and the console shows no list of what changed.
Who it’s for: IT lead or owner of a 10 to 250 person tenant who wants someone to look every month and say what changed.
Usually starts when: A first tenant report found stale and admin accounts, and you want to know when new ones appear.
The result: Every month you receive a ranked report of stale accounts, accounts without MFA, admin role holders, guests, and shared mailboxes and forwards with no owner, with what is new or closed since last month. Each finding has its evidence row and a decision column. Nothing is changed by us.
What stays true, and what we do about it
No response-time guarantee is published for this new service. A target for delivering each report is agreed in writing before it starts, set to what a service at this stage can keep.
Hours are agreed in writing before the service starts. At launch the service is not staffed round the clock and runs once each month.
What must remain true
- Every admin role holder is named and approved by the owner, or listed for a decision
- Accounts without MFA, stale accounts, guests, shared mailboxes and forwards are each listed with an owner or marked as having none
What we watch
- Read-only exports of users, roles, sign-in dates and MFA status
- The approved admin list and the stale-day rule you set
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A month closes and the exports are available. | We produce the report and summary and send them to the person you named. |
| A new admin role holder appears that is not on the approved list. | We put it first in the summary with the evidence row and ask who approved it. |
| A leaver's account is found still active. | We list it and offer the leavers check or the change-list job. Linked job: Leavers with live access |
| The exports stop arriving or change shape. | We say so and report nothing for that area until a working export is back. |
We do on our own
- Read the exports and compare them with last month
- Prepare the report and summary
- Offer a fixed job as a next step
We ask you first
- Any change to the stale-day rule or the approved admin list
- Any request for broader access than a read-only role
- Adding mailbox or file checks
We escalate to you when
- A new admin appears outside the approved list
- Unexplained admin changes appear; we list them first and make no judgement about a break-in
- The same finding is open three months running
How you know it held. Each month you can recompute the counts from the same exports, and the admin list in the report matches your console line for line.
How we keep it true
This service is never finished. Each month's report shows whether the thing it watches stayed true, and it continues until you end it.
See stale accounts, admins and missing MFA across Microsoft 365 or Google Workspace Job Optional
One report for your Microsoft 365 or Google Workspace account: no recent sign-in, no MFA (two-step sign-in), admin roles, guests, and mailboxes or forwards with no owner, each with its evidence row.
Bought separately; not part of the monthly fee
The one-off version, useful as the baseline.
Find people who have left but still have an account or seat in your apps Job Optional
A list of people who have left but still have an active account, seat or token in each app you name, with the export row behind every entry, and unlisted accounts shown apart.
Bought separately; not part of the monthly fee
Compares the tenant with your staff list and other apps.
What is included, and what is not
- The monthly ranked report
- The export reference for each finding
- A change-since-last-month list
- A one-page summary
Included
- One tenant of 10 to 250 people
- Account-level data only: sign-in dates, MFA status, roles, guests, shared mailboxes and forwarding rules
- State of accounts (stale, no MFA, admin roles, guests, shared mailboxes, forwards); risky sign-ins and unfamiliar locations are in the monthly sign-in and alert review
- Read-only exports you run, or a read-only role you create and can remove
- New and closed findings marked against last month
- A short summary with a question list
Not included
- Disabling accounts or changing roles
- Mailbox or file contents
- 24/7 monitoring, alert response or incident response
- Risky sign-ins and unfamiliar locations (see the monthly sign-in and alert review)
- A response-time promise
- Licence purchases
What you get to see
The customer deliverable is the running result and its evidence, not a pull request. The pull request stays an internal record.
- Request. Your request, as we understood it
- Agreed checks. The agreed checks that define done
- Test results. Test results against each check
- Independent review. An independent review and what it found
- Known limits. What it does not cover
- Acceptance. Your accept or change request
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Each month the admin role holders listed match your console list line for line, and every other count can be recomputed from the exports.
Evidence: The report, the console list and your recomputation.
Every finding points to an export row, and a 20% sample of at least 10 matches the live console with no false finding.
Evidence: Your marked sample.
No account, role or setting has been changed by us.
Evidence: Your own audit log for the month.
Sign-off. Your named IT admin reads each report and says whether the rules still suit you. A month counts as delivered when you have received the report and the summary.
If it fails. If we cannot run a month because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- A first tenant report has been done, by us or by you, so there is a baseline
- You run the exports yourself, or create a read-only role that can see every item on the list (we confirm the role with you before you create it)
- Sign-in logs are kept for at least 30 days, as your plan allows
- A named admin receives the report and acts on it
We stop and tell you if
- You want accounts disabled or roles changed by us
- You suspect the tenant is already compromised
- You expect round-the-clock alerts or a response time
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A finding is read as an audit, or as proof that the tenant is safe. | Each report says it is a data comparison with no assurance, and that it is not monitoring or incident response. |
| Sign-in data reveals when a person works. | We use last sign-in date at account level only and keep nothing after the month. |
| A read-only role is left in place. | You create and remove it, and your own audit log shows when it was used. |
A separate automated reviewer checks every report against the agreed test before it is sent. No person on our side reviews unless your agreement names one. Your named IT admin decides what to do with each finding.
Stays with a person
- Your named IT admin decides what to do with every finding
- You make every change in your own systems
Access we would need
- A read-only role that you create and can remove, or exports that you run
- Never a role that can change anything, and no admin credentials held by us between runs
Questions
Is this monitoring?
No. It is a monthly review from exports. There is no 24/7 cover, no alert response and no response time.
Do you need admin rights?
No. A read-only role you create, or exports you run.
What if the exports look like a break-in?
We list unexplained admin changes first and cannot judge whether a break-in happened. Incident response is not part of this service.
How is this different from the monthly sign-in and alert review?
This one reports the state of accounts: stale, no MFA, admin roles, guests, shared mailboxes and forwards. The sign-in and alert review reports events: risky sign-ins and unfamiliar locations.
Also part of
Send an enquiry
Send us
- Whether you use Microsoft 365 or Google Workspace, and your licence tier
- Your stale-day rule and your list of approved admins
- Who should receive the report
Later, once you agree
- Each month: exports from the admin console, or a read-only role you created, and last month's report
- Updates to the approved admin list
- The name of the admin who confirms a sample
You keep your systems and your files. We work on redacted or synthetic copies, or on exports you run yourself, and we hold no admin access between runs. Before any real personal data is shared, the written agreement names the model provider, its country and how long it keeps data, or the work runs on your own provider account.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-stale-and-over-privileged-accounts-reviewed-every-month” as the subject.