I support IT for a London agency of about 60 people. Macs, Microsoft 365, Slack, identity in Entra ID. The tools were fine.
The problem sat between them.
What I found
Joining and leaving the company was not written down. It worked because the right person happened to remember. That holds at 20 people. It gets shaky at 60.
I also ran a SharePoint permissions audit, using a ten section checklist I put together. The biggest finding was in sign-in settings. No policy blocked legacy authentication.
In plain terms, some old sign-in methods can’t ask for a second factor. If an attacker has a password, those methods let them in anyway. MFA on the front door doesn’t help if a side door is open.
One step I didn’t take
The checklist includes exporting the list of all active sites. I skipped it. That export pulls data nobody had formally approved me to pull. I’d rather be a day slower than explain later why I took it.
What I wrote
Five documents, all tied to the client’s real tools:
- A gap analysis with best practice recommendations
- An onboarding procedure, phase by phase
- An offboarding procedure where access ends the same day
- An IT lifecycle policy
- A phased action plan
I’m the one presenting and defending these, so I kept them short enough to actually be read.
What’s still open
A role-based access matrix is the natural next piece. It needs a clear list of roles and departments first. [Add one real outcome here: what the client changed, and when.]
If you run a company this size, ask yourself three things
- Can you list who has access to what?
- When someone leaves, who turns off what, and by when?
- Does anyone check sign-in rules, or only passwords?
If any answer is “I’m not sure”, that’s your starting point. My free assessment at itops.zlefterov.com takes you through 45 questions and shows where you stand.