Your Microsoft 365 Tenant Knows Too Much

Microsoft 365
Jackie Bilodeau

Written by Jackie Bilodeau

I am the Communications Director for CGNET, having returned to CGNET in 2018 after a 10-year stint in the 1990's. I enjoy hiking, music, dance, writing, cheering on Bay Area sports teams, and traveling near and far as much as I can. Read more about my work at CGNET here.

August 13, 2026

If you really want to understand your organization, you could interview the leadership team. You could survey employees. You could study the org chart.

Or you could just look at Microsoft 365.

Because hiding inside your tenant is a remarkably detailed history of your organization: current employees, former employees, old devices, forgotten consultants, abandoned Teams, mysterious SharePoint sites and approximately 47 workspaces named some variation of “Marketing.”

Yes, Microsoft 365 has been quietly keeping receipts.

Your Tenant Is an Accidental Historian

Nobody sets out to make their Microsoft 365 environment messy. It just happens. Someone creates a Team for a project. Someone else creates another because they can’t find the first one. A consultant gets guest access. A committee gets a SharePoint site. Someone experiments with Planner for three weeks.

Repeat for five years and congratulations: you’ve created an archaeological site. Dig around and you’ll find evidence of reorganizations, departed employees, former vendors, abandoned initiatives and possibly a SharePoint site dedicated to the 2019 holiday party.

The People Who Don’t Work Here

Start with user and guest accounts. How many belong to current employees? How many belong to former employees, contractors, interns or consultants? And why does Bob from that consulting firm you hired in 2022 still have access to anything?

Microsoft 365 makes it wonderfully easy to invite outsiders in. Unfortunately, nobody throws them a going-away party when their access is no longer needed. Guest accounts are often granted deliberately and removed…eventually.

Maybe.

Welcome to the Team Graveyard

Then there are Teams.

Creating one is so easy that organizations eventually end up with something like:

Marketing
Marketing Team
Marketing 2025
Marketing NEW
Marketing NEW FINAL
Some are active. Others haven’t been touched since everyone was making sourdough bread.

SharePoint isn’t immune either. Years of collaboration can leave behind sites nobody remembers creating, much less owning. This isn’t just digital clutter. Those forgotten spaces can still contain documents, conversations and permissions that matter.

Who Has the Keys?

Permissions tell an equally interesting story. Employees change departments, projects and responsibilities, but their access doesn’t always change with them. Someone who moved from Programs to Finance to Operations may still have permissions from every stop along the way. It’s like moving three times and somehow keeping the keys to all your old apartments.

Usually nobody intended this. Access simply accumulates. That’s why periodically reviewing who can see what—and who can share what—is so important.

And Then There’s Copilot

AI makes all of this considerably more interesting. Copilot doesn’t simply give people access to information they aren’t authorized to see. But it can make information they are authorized to see much easier to find. That forgotten document buried six folders deep on an old SharePoint site? If the permissions are too broad, AI can make finding it a lot less difficult.

Copilot didn’t create the mess. It just showed up with a really good flashlight. Which is why cleaning the attic before handing out flashlights is probably a good idea.

Your Mess Is Trying to Tell You Something

A Microsoft 365 cleanup isn’t about achieving some mythical state in which every Team is perfectly named and every SharePoint site has a loving owner. We’re still dealing with human beings here. It’s about seeing what the clutter reveals.

Old accounts may expose weaknesses in offboarding. Forgotten guests may point to missing access reviews. Abandoned Teams and SharePoint sites may contain information that should be archived. Old devices may reveal gaps in device management. Strange permissions may suggest that nobody has looked at permissions since “Tiger King” was popular.

Your Microsoft 365 tenant isn’t just a collection of software. It’s a record of how your organization actually works—and all the stuff it forgot to clean up along the way. So if nobody has looked under the hood lately, it might be time.

Otherwise, be prepared to meet Marketing NEW FINAL 2.

 

 

For over forty-three years, CGNET has provided state-of-the-art IT services to organizations of all sizes, across the globe. We’ve done it all, from IT and cybersecurity assessments to cloud services management to generative AI user training. Want to learn more about who we are and how we might be able to help you? If so, check out our website or send us a message!

 

You May Also Like…

You May Also Like…

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Translate »
Share This
Subscribe
CGNET
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.