Microsoft 365 Permissions Audit
Exodesk reviews who can access the Microsoft 365 content included in your audit and whether that access matches your business needs. We identify oversharing, stale permissions and unclear ownership, then prioritise the findings with your content owners.
Start with an agreed scope and a findings report. Any permission changes, structural work or ongoing reviews are agreed separately.
Tell us what is prompting the review and which sites, teams and mailboxes matter to you
What is a Microsoft 365 permissions audit?
A Microsoft 365 permissions audit reviews who can access the sites, files, mailboxes and other resources agreed in scope, how that access is granted, and whether it matches the business owner’s intent. It produces prioritised findings and recommendations.
The review is read-only and uses access your business authorises. Report exports are kept only as long as agreed, then removed. Preparing for Copilot is one reason to review permissions; the same work supports everyday collaboration, external sharing and staff changes.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
When a permissions audit helps
Access builds up as people join, move and leave, and as projects open sites that outlive them. These are the common points to check it.
Before a Copilot rollout
Check what the first users can already access before an assistant makes existing access easier to find.
Role changes and leavers
Find access that outlived a role, delegations granted to a previous person and accounts nobody owns.
External collaboration
Review guests, Anyone links and shared channels after work with clients, contractors or partners.
Mergers and restructures
Bring combined tenants, teams and sites back to an access model the new business intends.
Unreviewed older sites
Confirm owners and audiences for project and department sites created years ago and seldom visited.
Accountability
Document what was checked and decided, so access choices can be explained later.
Resources and access paths in scope
The scope lists the resources and access paths included, and records anything excluded. Not every resource is covered by default.
- SharePoint and OneDrive. Sites and accounts in scope, with direct access, groups, inherited permissions, sharing links, owners and guests; OneDrive gets its own governance checks
- Teams. Standard channel files use the parent team site, while private and shared channels have separate sites and membership rules, so each is reviewed on its own terms
- Exchange. Full Access, Send As, Send on Behalf and folder delegation recorded separately, because sending rights alone do not give read access
- External sharing. Anyone links, guest access and their expiry settings, which are separate controls from the lifecycle of guest identities
- Administrative and app access. Relevant admin roles and application permissions, kept distinct from the access of a normal staff account
- Other sources. File shares, connectors and agents included only where specifically commissioned and recorded separately
Findings your owners can act on
You receive the agreed scope and coverage, prioritised findings, the owner decisions needed, recommended changes and a practical next-step plan.
Findings are ranked by sensitivity, actual audience, external exposure and business impact across the agreed scope, not by count. Two hundred inherited folders inside a team’s own site can matter less than one sensitive library open to everybody. Approved company-wide content may be correct as it is.
Serious findings are escalated promptly to your authorised contact, whether or not they sit inside a planned Copilot pilot. The audit does not change permissions: any urgent containment follows pre-agreed authority or a separately approved instruction, with the action and scope recorded. Lower-risk findings get an owner and a due date. Approved changes and validation follow the path shown, as separately agreed work.
Permissions and Microsoft 365 Copilot
Copilot respects existing permissions. Microsoft’s Copilot privacy documentation says it only surfaces organisational data to which individual users have at least view permission, so content that is already overshared becomes easier to find.
Permissions establish what someone is eligible to see; supported sources, indexing, the app in use, policies and retrieval affect what is actually returned. In a permissions audit we therefore review access rather than predicting the exact answer to any prompt. Mailbox access, indexed discovery and app-specific features also differ, so we check the actual tenant and client experience. Our Microsoft Copilot page covers the product, and AI data security covers what happens to prompts and outputs.
- Restricted Content Discovery. A temporary discovery control for selected sites that does not change permissions, block direct access or affect content a user already has open, and takes time to propagate
- Restricted Access Control. An additional condition for users the policy covers: they need allowed-group membership as well as underlying permission, and membership alone does not grant access. Private and shared channel sites need their own configuration, and external shared-channel participants from another tenant are reviewed separately because the policy does not evaluate them
- SharePoint Advanced Management. Several governance reports and controls are available once a qualifying Copilot licence is assigned to at least one user, while features such as restricted site creation have other licensing routes, so entitlement is checked against the tenant and the feature before anything is quoted
Discovery controls and a small pilot buy time; they do not replace fixing sensitive exposure.
Inheritance, ownership and safe changes
Inheriting permissions from a deliberately scoped site or library is a valid and manageable design. The finding is a mismatch between effective access and the approved business need.
We prefer suitable site and library boundaries and managed groups, with item-level exceptions only where needed and documented. Removing a direct grant is not enough if a wider group or link still gives access. For sites without a named owner, we identify an accountable business owner, because the owner confirms who should be there. Your authorised business contact can approve urgent containment while ownership and the intended long-term audience are confirmed. Ongoing joiner, mover and leaver discipline belongs with identity and access management, and site structure with our SharePoint intranet service.
Removing permissions can interrupt work. Approved changes follow owner sign-off, dependency checks, an agreed change window, a recorded starting state and a controlled restoration route.
How changes are validated
Access tests are the acceptance criteria. Search and Copilot prompts are supplementary checks, because a missing answer is not proof that access was removed.
- Agree expected results. Allow and deny results agreed with the content owner, using authorised test accounts and harmless test material
- Check effective access. Group membership, direct and inherited grants, sharing links and mailbox rights reviewed, with known resource URLs and required tasks tested
- Repeat after changes. Both denied-access and required-access tests repeated after propagation, and the recorded permission state compared
- Record what remains. Residual risks, unresolved coverage, owners and due dates recorded, with review frequency set by risk and change
Information privacy principle 5 requires reasonable security safeguards for personal information. We can support those safeguards through a permissions audit, and documenting checks and decisions supports accountability, but it does not by itself establish compliance.
How a permissions audit proceeds
Each audit follows the same sequence, with changes kept separate from the review.
Agree scope and access
Confirm the resources, exclusions, content owners and the read-only access your business authorises.
Review access paths
Inventory groups, direct grants, inheritance, links, guests and mailbox rights within scope.
Discuss with owners
Walk owners through the findings that need a business decision about the intended audience.
Report and plan
Deliver the prioritised findings, recommended changes and next steps, then remove exports as agreed.
Approved changes, if commissioned
Make separately approved changes, validate them and set the review schedule.
What affects the cost?
We quote a permissions audit from the scope: the number of sites and OneDrive accounts, mailbox scope, external sharing, unique permissions, connected sources and owner availability.
- Assessment. The review and findings report for the agreed resources
- Remediation. Approved changes and validation, quoted separately once findings are known
- Licensing. Any licence a required feature depends on, checked against your tenant first
- Ongoing review. Scheduled reviews, with frequency set by risk and change
The proposal states what is included in each part before work starts. Wider control reviews sit with our security audit service.
Permissions audit questions
What is oversharing in Microsoft 365?
Oversharing occurs when people can access content beyond the audience the business owner intended. It can arise through groups, direct grants or links. Inherited access is only a problem when the parent permissions are inappropriate.
What does Everyone except external users mean?
It is a broad SharePoint principal covering internal users under Microsoft identity rules. Use it only where organisation-wide access is intended, and review the actual site audience rather than treating it as a maintained list of current employees.
Is a permissions audit the same as a security audit?
No. In a permissions audit we focus on access to the Microsoft 365 resources agreed in scope, while a broader security audit reviews a wider set of controls. We can help determine which review fits the problem.
How long does a permissions audit take?
Timing depends on the resources, access paths, reporting tools and owner decisions involved. We confirm scope, milestones and dependencies before work begins, and remediation timing is agreed separately.
Can an internal administrator review permissions?
Yes. Admin reports, tools and scripts can support the review. A useful audit also checks coverage, effective access, business intent, priorities and ownership, because tool output alone does not settle who should have access.
Is SharePoint Advanced Management required?
Not for every permissions review. SAM adds reporting and governance capabilities, and some are included once a qualifying Copilot licence is assigned to at least one user. Other features and licensing routes have different prerequisites. We check the tenant and required features before quoting.
Can removing permissions interrupt work?
Yes. We confirm required access with owners, check dependencies, make approved changes and test essential tasks. A controlled restoration route is kept, and validation confirms inappropriate access has gone.
Must every permission issue be fixed before a Copilot pilot?
Not every lower-risk issue. Address unacceptable exposure before enabling affected users and assess serious findings across the tenant. A small pilot is not a substitute for checking what its users can access.
What should happen when someone leaves?
Disable the account and follow the offboarding process for session revocation, application access, relevant grants and ownership transfer. Disabling an account is not an instant recall of every copy, so surviving links, delegations and downloaded files are reviewed too.
Discuss your permissions audit
Tell us what is prompting the review, roughly how many sites, teams and mailboxes are involved, and whether Copilot is planned. We will suggest a scope for the permissions audit and the next step. Please leave passwords and admin credentials out of the enquiry.
Talk to us about a permissions audit
Tell us your business, the Microsoft 365 areas you want reviewed and what prompted the question, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941