The account can then be removed once the data has been exported and that part of the form signed off.Ĭoming back to the stale Microsoft 365 accounts: Attackers are always looking for ways to get access to a company. When it comes to the mailbox, it can be exported to PST, and if any manager or employee needs access to it, they can give access to the PST file. If data is saved to a share or SharePoint, then the IT department can reformat the machine. So, the question arises: How do you manage accounts that are have not been accessed in a while, and what do you do with the data? The HR department should have a form where the employee needs to have each section signed off. You can free up those licenses and allocate them elsewhere or to new staff members when they join. In Microsoft 365, you do not want to have accounts lying around with licenses assigned. If User A’s computer gets compromised, the attacker not only has access to User A but also User B. After a while, they do not use the account anymore, but it remains active. You could also look at it from a different angle where User A has full access to User B’s mailbox and permissions as they need to look after the mailbox in a transition phase. Many attacks don’t happen immediately, as the attacker collects information before they launch an attack. If the account is hacked, the attacker will have full domain privileges to do what they want. Another example is an IT staff member who has a management account.
If the account gets compromised, the attacker can navigate a long way into the environment because of the elevated permissions. Let’s say that User A, who was high up in the HR department, left the company, but her account, mailbox, and permissions remained intact. Stale Microsoft 365 accounts: An invitation to attackers The number of stale and old accounts has been exacerbated by the rush to Microsoft 365 during the pandemic. Or if you running hybrid, you may have Microsoft 365 accounts on-premises as well that are stale and should be removed. They are in Active Directory and Exchange Online with an active mailbox. Some admins have the impression that the account is disabled, so why the big concern? Well, sometimes you think that accounts are disabled, but they are not.
Cleaning up accounts has always been a problem, especially for large organizations or universities that turn over many accounts regularly. Stale accounts in any environment are an IT administrator’s nightmare.
0 kommentar(er)
