EndKeep, notes from the tenant

Three of twelve users had no MFA. Here is how that happens.

Sat, 12 Sep 2026 08:00:00 +0500

A twelve person firm, Business Premium, a sensible owner. Three accounts with no MFA at all. Nobody did anything wrong. Here is the sequence.

Microsoft's security defaults were on when the tenant was created, then someone turned them off to make a printer scanner work, meaning to put them back. Two contractors were added with the "skip MFA for now" habit. The third was the owner's own second account, created for a shared inbox and forgotten.

None of that shows up in the admin centre unless you go looking. It shows up the day a phished password is used from another country.

The fix takes an hour

One Conditional Access policy requiring MFA for all users, a break glass account excluded, report only for a week to see who it would catch, then on. The scanner gets an app password or a proper SMTP relay. That is the whole job.

If you want to know your number, the $250 Health Check answers it in two days.

Six Business Premium licences nobody used, $130 a month, found in ten minutes.

Sat, 05 Sep 2026 08:00:00 +0500

The licence page in the Microsoft 365 admin centre is the most expensive page nobody reads.

Six seats assigned to people who left, a shared mailbox and a test account. At $22 a seat that is $132 a month, $1,584 a year, for nothing. It paid for the assessment that found it twice over.

Why it happens

Leavers get disabled but not unlicensed. Shared mailboxes get created as users. Someone buys a seat for a test and never removes it. There is no monthly ritual to check.

The fix is a leaver runbook that includes the licence, converting shared mailboxes properly, and a licence line in the monthly report so it never drifts again. We put that line in every report we send.

The leaver who could still read email eight months on.

Sat, 29 Aug 2026 08:00:00 +0500

Disabled in the HR system. Laptop returned. Still signed in on a phone, still receiving every email to a shared mailbox they had been added to.

Disabling an account does not kill existing sessions, and it does not remove the phone from the mailbox. Revoking sessions does. Removing the device from Intune does. Neither happened because neither was on the list.

The same day leaver process

Disable the account, revoke all sessions, reset the password, remove from every group and shared mailbox, retire or wipe the device in Intune, convert the mailbox to shared with forwarding to the manager, reclaim the licence after thirty days. Written down, in that order, done by whoever is on shift.

It takes twenty minutes. Not having it is how you end up explaining to a client why their emails were read by someone who does not work for you.