Which apps can access company email without an employee's password? Unused apps may retain access to email and files. Ask IT to review and resolve unexplained permissions.
⬇ Download PDF No sign-up, no contact details required. Need a print version? ↓
PDF · 11 pagesOpen Entra → Enterprise applications → Permissions. Check email and file access. Note unnecessary permissions.
→ The responsible person confirms required access. IT removes agreed unnecessary permissions and tests the service.
This is a first step, not a replacement for all the checks.
Select a check to see the instructions: what good looks like, how to check, the red flag and what to do.
IT has listed connected Microsoft 365 apps with their names and IDs.
Open Entra → Enterprise applications. Compare apps with company services. Note unfamiliar ones.
An app has access, but nobody knows who connected it.
IT records the app's name and ID and identifies who connected it.
The responsible person has explained the app's purpose, users and services affected by disconnection.
Ask the department head or contractor why the app is needed, who uses it and when it was last used. Record the answer.
Nobody can explain why the company needs the app, yet it still has access.
The owner assigns someone to establish the app's purpose and the impact of disconnection.
IT has reviewed data access. The responsible person has justified required permissions.
Open Entra → Enterprise applications → Permissions. Check email and file access. Note unnecessary permissions.
The app can access or change data beyond its needs.
The responsible person confirms required access. IT removes agreed unnecessary permissions and tests the service.
IT has reviewed third-party admin permissions and documented their purpose.
Open Entra → Roles and administrators. Identify apps allowed to manage email or other services.
An app can manage Microsoft 365 without a justified need.
IT reviews permissions, obtains approval, removes unnecessary access and verifies the result.
IT has recorded the review period, explained unusual activity and noted unavailable records.
Open Entra → Sign-in logs → Service principal sign-ins. Compare times and sources with expected activity.
An app signs in from an unexplained source.
IT investigates unusual sign-ins and immediately restricts confirmed unauthorised access.
IT knows how to stop and verify access. The owner understands potential service disruption.
Ask IT how to stop access and whether backups, email recovery or essential services depend on it.
Nobody knows how to disconnect the app safely.
The owner approves any planned change. IT implements it when needed and verifies the result.
Stopping access does not undo exposure. Incomplete logs cannot rule out breaches.
Two pages: a handout with the checks and a 30-day tracker, and a form to fill in by pen.
Download A4 sheetsUse the document as the basis for your rules. Tick the checks for 30 working days until they become a habit.
The owner or manager decides which checks are mandatory and who owns them.
Who performs a check and who confirms it. Where possible, two different people.
Print the A4 sheet and keep it where the process happens.
Tick the checks daily, record exceptions and refine the rules when needed.
After 30 days you have an agreed rule, owners and a record of checks. Not a guarantee of security, a working practice.
We can independently test whether these controls work in practice, not only on paper.
Penetration testing specialist. Helps companies find vulnerabilities in web applications, APIs and infrastructure and decide which risks to fix first.
About Veiltrack → Questions about the security of your processes? Discuss your situation →
This guide contains general recommendations. The controls available to you depend on your company and the services you use.
