Former employee. Temporary contractor. Vendor who finished the project last spring.
Their accounts may still be active.
That can leave a door open to client files, patient information, financial records, email, and business systems long after someone no longer needs access. For a small firm without a dedicated identity team, the risk often starts with a simple gap: no one owns the full list of who can get in.
Good account security is not a one-time cleanup. It is a repeatable process for granting, changing, reviewing, and removing access.
The “Hey Margaret!” account
“Hey Margaret! Can you pull the client file and send it over?”
Margaret left months ago. Her Microsoft 365 account still works, her access to a shared mailbox was never removed, and a vendor login is still saved in a browser.
No one intended to create a problem. The process just depended on someone remembering every account, app, and device.
That is a weak spot for law firm cybersecurity, medical practice IT, and accounting firm IT alike. Attackers may try to exploit abandoned accounts, but risks can also arise from a lost device, an old session, or access that was simply broader than the job required.
MFA helps verify a sign-in. It does not make unnecessary accounts disappear. And disabling an email account alone does not necessarily revoke access to every connected application, device, or vendor portal.
Start with a complete access inventory
You cannot revoke what you do not know exists. Build a current list of:
- Employees, contractors, guests, and vendor accounts
- Microsoft 365 and Entra ID users, groups, roles, and shared mailboxes
- Line-of-business apps: case management, electronic health records, tax and accounting platforms, billing, e-signature, and scheduling
- Remote access, VPN, Wi-Fi, and vendor support accounts
- Service accounts and application connections
- Company laptops, phones, and tablets managed through Intune or another endpoint tool
For each person or account, record its owner, business purpose, systems it can access, authentication method, and review or expiration date. Flag privileged accounts and accounts that can reach especially sensitive data.
Then ask the most important question: Who is accountable for confirming this access is still needed? If the answer is “I got a guy,” you may have found the first process to formalize.
A practical account security checklist
1. Make onboarding an approved request, not an assumption
Before creating access, confirm the person’s identity, start date, manager, role, device, and required applications. Have an authorized manager approve the request.
Grant access through role-based groups where possible. That makes it easier to give someone the permissions needed for their work without granting access to every client matter, patient record, or financial folder.
Use least privilege: the minimum access required to do the job. A new hire should not inherit broad permissions simply because it is faster than deciding what they need. Keep administrative work separate from everyday email and browsing; only designated staff should have elevated roles.
2. Require MFA and make device access part of the decision
Require multifactor authentication (MFA) for users, with particular attention to administrators and anyone accessing sensitive systems. MFA adds a verification step beyond a password. It reduces the risk that a stolen password alone will be enough to sign in.
Microsoft recommends MFA for users and emphasizes protecting privileged accounts. Depending on your Microsoft 365 licensing and setup, security defaults or Conditional Access can help enforce sign-in rules. Conditional Access can also consider whether a device is managed or meets your security requirements.
Use Intune to set and monitor device requirements where appropriate, such as encryption, screen locks, updates, and endpoint protection. Test policies before rolling them out broadly, so security controls do not unexpectedly disrupt work.
MFA and endpoint security are important layers, not a substitute for removing old accounts or reviewing permissions.
3. Treat role changes as access changes
People change jobs without leaving the firm. A medical billing employee may move into operations. An attorney may change practice groups. An accounting staff member may take on different client responsibilities.
When that happens, remove the access they no longer need as you add access for the new role. Otherwise, permissions accumulate. Microsoft describes this identity lifecycle as join, move, and leave. A helpful model for managing employee and guest access over time.
4. Offboard across every system
A departure checklist should be triggered by an authorized HR or management notice and coordinated with IT. Set the time access ends, then check every account, not just Microsoft 365.
On departure, as appropriate to the situation:
- Block sign-in and revoke active sessions and tokens.
- Remove access to groups, shared mailboxes, Teams, SharePoint, remote access, and third-party applications.
- Remove administrative roles and vendor permissions.
- Recover company devices; use Intune or other management tools to lock, retire, or wipe them when appropriate.
- Rotate shared credentials the person may know.
- Preserve and transfer business records under your retention, legal-hold, and operational procedures.
- Record who completed the actions, when, and any approved exceptions.
Do not indiscriminately forward a former employee’s email or delete their files. A law firm may need to preserve matter records; a medical practice must follow its record-handling procedures; an accounting firm may have tax and business records to retain. Coordinate retention and transfer decisions with the appropriate leaders and counsel.
For more on common offboarding gaps, see The Ghost in Your Directory.
Set a review cadence your firm can sustain
One annual review is better than none, but it may not catch a problem quickly enough. Use a schedule with clear owners:
- At onboarding, role change, and departure: Review and update access as part of the event.
- Monthly: Check for disabled or inactive accounts, expired guests, departed users, unused vendor access, and unexpected privileged accounts. Investigate before deleting; preserve data as required.
- Quarterly: Ask managers or system owners to confirm that each person still needs their access. Review vendors and guests, too.
- Monthly or more often: Review administrator accounts and high-impact access, such as email administration or systems holding particularly sensitive information.
- After an incident, major change, or vendor transition: Reassess affected accounts, credentials, devices, and permissions.
Document the review date, reviewer, decisions, and remediation. A review that finds excess access but never removes it is only paperwork.
Compliance: important, but not one-size-fits-all
Access control is relevant to many organizations’ security and confidentiality responsibilities, but the specific rules depend on what your firm does and which laws or contracts apply.
The FTC Safeguards Rule applies to certain financial institutions under FTC jurisdiction; it does not automatically cover every law firm or medical practice. Some tax-preparation businesses and other financial activities may bring an organization within scope, depending on its services and circumstances. Covered organizations should review the FTC’s Safeguards Rule guidance and the current rule text with qualified advisers.
A medical practice may have obligations under HIPAA if it is a covered entity or business associate. Law firms also have confidentiality and professional responsibilities. Contracts, state laws, and other requirements may apply across all three sectors. This checklist is operational guidance, not legal advice; confirm your specific obligations with qualified counsel or compliance professionals.
In-house or managed IT? Weigh the tradeoffs
An internal team can provide close knowledge of your people and workflows, and direct control over decisions. But the process may depend on one busy generalist, incomplete application records, or staff remembering to coordinate every departure. Training and turnover can also make procedures inconsistent.
A managed IT partner can help standardize onboarding and offboarding, maintain Microsoft 365 and Intune controls, support endpoint security, and coordinate access reviews. That can offer economies of scale, but your firm still needs to define approvals, retention decisions, and who owns the process. A provider should make responsibilities clearer, not obscure them.
Think of account governance like routine medical care. A clinician does not rely on a patient’s memory alone for every medication and follow-up. A reliable process uses records, clear ownership, and regular check-ins. Your firm’s access controls need the same discipline.
Final Word
Stale access is easy to overlook because it rarely announces itself. A former employee’s account may still receive email. A vendor login may still open a portal. An old permission may still expose a folder.
Build a practical joiner–mover–leaver process. Require MFA. Use least privilege. Keep identity and device records current. Review accounts on a schedule, and document what you change.
If your firm needs help putting those controls into practice, explore managed IT services, cybersecurity services, or our article on securing your Microsoft 365 tenant. A PC of Mind helps professional-services firms make access security an ongoing part of reliable, well-managed IT, not a task left to memory.
