Microsoft 365 access reviews: what financial firms should check before quarter end

Before quarter end, UK financial firms should be able to explain who can access investor records, shared mailboxes and confidential deal documents, and why. Microsoft 365 access reviews help uncover permissions that outlast a role, contract or business need.

The FCA's data security guidance identifies access checks when people join, change roles and leave as good practice. Use quarter end as an additional checkpoint, with review frequency based on risk and changes addressed promptly.

Quarter end review checklist

Suggested approvers and evidence for the checks below.

Review area	Key check	Suggested approver	Evidence to retain
Privileged access	Role still needed	Independent authorised reviewer	Approval and change record
Dormant accounts	Current employment and role	Line manager	HR check and action record
External access	Sponsor and end date	Business sponsor	Resource list and expiry
App permissions	Business need and scope	Application owner	Consent review and change record
Review closure	Changes actually applied	Accountable manager	Exceptions and verified removals

Define the scope and decision makers

Microsoft Entra access reviews can support recurring reviews of group memberships, enterprise application access and privileged roles. Features depend on the relevant Entra licences, so check entitlements before planning automation.

Start with investor reporting sites, finance mailboxes and administration rights. Business or data owners should confirm the need for access; IT or the managed service provider should implement changes. Compliance should oversee exceptions and evidence requirements. Record the resources covered, including permissions requiring separate checks outside Entra's review workflow.

Reassess administrator privileges

Check who holds Global Administrator and other powerful roles, including external support personnel. Require a current reason for each assignment and assess whether narrower permissions would support the same task.

Where Privileged Identity Management is used, review active and eligible assignments: eligibility still allows someone to activate a role. Include workload-specific administrator permissions in the wider assessment. Have another authorised person approve privileged access. This supports the identity controls discussed in Alternit One's article on Zero Trust for hedge funds.

Reconcile dormant accounts and role changes

Compare accounts and group memberships with HR records and contractor end dates. Investigate inactive accounts, departed staff and employees who retain permissions from previous roles. Treat inactivity as a prompt to investigate; check legitimate exceptions such as extended leave before changing access. Recent activity does not justify access either; the reviewer should confirm what the current role requires.

Review shared mailbox delegation, including who can read correspondence or send messages on the firm's behalf. A move between investment teams should also trigger checks of old deal folders and reporting groups.

Examine guest access and sharing links

Ask each business sponsor whether external advisers, auditors and consultants still need access, to which resources and until when. A completed transaction should prompt reassessment of its collaboration spaces.

SharePoint permissions and sharing links require particular attention. Access can be granted separately from Microsoft 365 group membership, while Anyone links allow unauthenticated access. Check sensitive sites for direct permissions and inappropriate sharing links, alongside Teams membership. Teams shared channels also need separate attention because external participants do not necessarily appear as guest accounts. Removing someone from one group does not establish that every route to the information has closed.

Review permissions granted to applications

A user access review checks who can use an application. Separately, inspect permissions granted to enterprise applications, which determine what organisational data an integration can access.

For each integration, identify its owner, business purpose and approved permissions. Prioritise broad access to mail, files or directory data, and investigate tools whose original sponsor has left. Have the application owner assess operational dependencies before IT revokes unnecessary permissions. Record any accepted exception and its expiry date.

Apply decisions and retain evidence

Confirm that denied access has actually been removed. Microsoft's guidance on completing reviews distinguishes recording decisions from applying them. Automatic application depends on configuration; nested groups and groups synchronised from an on-premises directory can require additional action.

Agree how non-responses will be handled before the review starts. Escalate unanswered decisions to a nominated owner, and test approved changes against critical reporting workflows so that unnecessary access is removed without interrupting legitimate work.

Retain the review scope, dated access lists, named reviewers, decisions and reasons. Add change records and evidence of completed removals, with owners and deadlines for outstanding actions. Store these securely under the firm's retention policy. This creates a traceable record for management oversight and investor due diligence.

Prepare for the next reporting cycle

Before sign-off, report unresolved privileged access, overdue decisions and unverified removals to the accountable manager. Schedule the next review around risk and business changes.

Alternit One's cybersecurity services include Microsoft 365 identity and access controls. Speak to Alternit One about structuring access reviews around your firm's systems, reporting cycle and governance responsibilities.