Defend
Access reviews
Access is granted on a busy day and rarely taken back. An access review goes through who can open what, with the people who know the work, and the result goes into your evidence file.
Access that made sense last year quietly stays.
A colleague helped on a matter two years ago and can still open its files. A guest from another firm was given a folder for one project and still has it. The former assistant’s mailbox is still shared with three people. None of it was decided; it accumulated. An access review puts a stop to that: regularly, and with you, we go through who can open which files, mailboxes, teams and systems, and whether they still should. What’s no longer needed is removed. What stays is confirmed by someone who knows the work, not by whoever set it up. That’s what a client’s security questionnaire, your insurer and your auditor mean when they ask how you control access.
What we do
Reviewed with the people who know the work.
A review is only as good as the person confirming it. So we prepare the lists, and the people who run the matter, the client or the project decide what stays.
-
The lists, prepared
For each matter, client or project folder, each shared mailbox, each team and each system: who can open it today, and since when. Prepared by us from the tenant, in a form a lawyer or a project lead can confirm in one sitting.
-
Confirmed by the owner
The person responsible for the work confirms each name or strikes it. Nobody confirms their own access, and nobody confirms a list they don’t understand.
-
Guests and outside sharing
Every guest account and every link shared outside the firm is on its own list. Sharing that was meant for one project ends when the project does.
-
Admin and privileged access
Who holds admin rights in Microsoft Entra ID, on servers and in applications, ours included, reviewed on the same cycle and confirmed by your leadership.
-
Removed, and confirmed removed
What was struck is removed, and the removal is checked against the tenant afterwards, so the review changes access and not just a spreadsheet.
-
On a cycle, and after events
A regular cycle agreed with you, and an extra review after a merger, a carve-out, a provider change or a reorganisation, when access changes the most.
On record
In your evidence file.
- The date of the last review and who confirmed each area
- Who can open what, as it stands after the review
- What was removed, and that the removal was checked
- Guest accounts and outside sharing still in force, each with its reason
The answer to “who can open this client’s files?”, dated and signed by someone who knows.
What usually goes wrong without it.
-
Access that only ever grows
Every project, every stand-in and every favour adds access. Nothing removes it. After five years, most people can open most things.
-
A review signed by IT, not by the owner
IT confirms the list because nobody else was asked. IT doesn’t know who still works on the matter, so everything is confirmed.
-
Guests nobody remembers
Accounts from a firm you worked with once, still able to open the folder they were given. The review that finds them is the client’s questionnaire.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
How much of our people’s time does a review take?
Short enough to confirm in one sitting. We prepare the lists so that the person responsible only confirms or strikes names; they never have to dig through the tenant themselves. The cycle is agreed with you, so it lands at a quiet time, not on deadline day.
Does this cover our AI assistant too?
It’s the foundation for it. An AI assistant shows people what they’re allowed to open, so an access review done before it’s switched on decides what it can show. Permissions first, then the assistant.
What about access your own engineers hold?
It’s on the same list. Our engineers’ admin access is reviewed on the same cycle as everyone’s, confirmed by your leadership, and every use of it is logged. We hold the most powerful accounts in your firm, so our keys are the first ones on the list.
Can we show the result to a client or an auditor?
Yes. The evidence file holds the date, who confirmed each area, what was removed and what remains. That’s what a questionnaire means by access control, and it’s ready before it’s asked for.
Start
Who could still open last year’s matters?
In a first call we go through how access is granted and taken back at your firm today, who last checked it, and what a review would find.
- No first level
- No surprises
- Pilot before you buy