Who Still Has a Key to Your Business?

Systems hygiene sounds like a chore your IT person keeps postponing. (Fair. It usually is.) Here's a quick test of whether that's costing you: think of the last person who left your company. There was a goodbye thread in Teams, a card that made the rounds, maybe a last-day lunch. Now the harder question: who turned off their accounts? All of them?

If you paused just now, you're in good company. Most business owners can name every physical key to the office. Almost none can name every digital one.

Here's the short version: every account in your Microsoft 365 or Google environment is a key to your business. A stale account is a key you cut, handed out, and stopped tracking. And the messier your directory gets (wrong titles, dead accounts, an org chart from two reorgs ago), the more doors you can't account for, right at the moment you're thinking about handing the whole building over to an AI assistant that believes every word your systems say.

What is systems hygiene?

Systems hygiene is the practice of keeping your business systems accurate: every account belongs to a current person, every job title and manager is right, permissions match what people actually do, and accounts get turned off the day their owners leave. In a Microsoft 365 or Google Workspace environment, it's the difference between a directory that describes your company and one that describes every company you've ever been.

That's the whole definition. Nothing in it requires new software, and nothing in it is optional anymore, for two reasons we'll get to: attackers and AI.

Why this matters for you specifically

You're not running a Fortune 500 identity program. You have a 20-to-200-person company, someone who handles IT alongside three other jobs, and a tenant that grew the way most do: an account created the morning someone started, tweaked when they changed roles, and quietly forgotten when they left. Multiply that by every hire, departure, contractor, and intern since you opened the doors.

That's not a moral failing, and it's not laziness either. It's a thing brains do: when something is everyone's job, it's no one's job. A directory never has a bad day and calls you about it. It just quietly drifts, until your systems no longer describe your company. They describe every company you've ever been, all at once.

Picture it concretely. There's the account for the office manager who left in 2023, still licensed, still getting email. There's a shared mailbox named for a product you discontinued. There's "Temp - DO NOT DELETE," and nobody remembers why not. Each one made sense the day it was created. Together they're a floor plan of rooms you forgot you built.

Microsoft has a name for the worst of it: inactive accounts. Their guidance is blunt about why they matter. Accounts often don't get deleted when employees leave, and every one that lingers is a standing security risk. Their rule of thumb is that an account with no sign-in for 90 to 180 days deserves a hard look. (No judgment; almost every tenant has a few. The question is whether anyone's counting.)

What does a messy tenant actually cost?

A messy tenant costs you in attack surface — basically, the number of ways into your business. Every active account is one way in. That's fine; your team needs their keys. The problem is the accounts that are ways in with nobody on the other side.

A stale account is an attacker's favorite kind of target, because the attack that actually reaches small businesses is rarely exotic. Microsoft's Digital Defense Report says they blocked 7,000 password attacks per second over the past year, and that password-based attacks make up over 99% of the 600 million identity attacks they see daily. That's the front door being tried, constantly, on every account you have. Your active people have fresh passwords, MFA, and a human who notices a login alert at 2am. Your stale account has an old password, probably reused somewhere that's been breached, and nobody on the other side to say "that wasn't me." When you trim those accounts, you're not doing housekeeping. You're bricking up doors that only led inward.

My brother Raiden (Summit's solutions architect, and the one in the family who reads sign-in logs for fun) puts it more bluntly: attackers don't pick the strongest lock. They walk the building looking for the door nobody's watching.

And it's not just the dead accounts. Wrong job titles and stale groups mean people keep access they shouldn't have. The bookkeeper who moved to sales still opens the payroll folder. The "Marketing Team" group still includes two contractors from last spring. None of it is malicious. All of it widens what security people call the blast radius: how much of your business one compromised login can touch on the day something does go wrong.

Sound familiar?

The AI part nobody warns you about

Here's the piece that changed the urgency on this. Every AI tool you're being sold right now (Copilot chief among them) learns your business by reading your systems. Your directory, your files, your permissions. It's like a brilliant new hire who memorizes everything on day one and never doubts a word of it.

If your systems say the wrong person runs operations, your AI believes that. If your org chart is stale, every "route this to the right person" automation routes wrong. Garbage in, confident garbage out, at machine speed, with a friendly tone.

Permissions are the sharper edge. Microsoft is clear that Copilot only surfaces content a person already has permission to see. That sounds reassuring, and it is — right up until you remember what your permissions actually look like. Copilot doesn't create oversharing. It reveals it. That folder half the company could technically open but nobody ever found? Now there's a search engine for it, and it answers in full sentences.

So the AI readiness question isn't "which tool should we buy?" It's "would we be comfortable with an assistant that believes everything our tenant says?" For most companies the real answer is not yet. And the fix isn't a bigger license; it's hygiene.

What can you do Monday morning?

You can audit your own tenant in about ninety minutes with tools you already own: no new software, no project plan. Four steps: find the accounts nobody's using, check them against your departure list, fix the worst of the directory, and look at who can reach your most sensitive data.

1. Count the keys. In the Microsoft Entra admin center, add the "Last interactive sign-in time" column to your user list and sort it. Google Workspace has the same view. Anything past 90 days goes on a list for a human decision: disable, or defend why not.
2. Check the departed. Pull your last year of departures from HR or payroll and check each name against that list. Every match is a door you thought was locked.
3. Fix ten titles. Skim the directory for job titles and managers. Fix the ten most wrong. Ten minutes, weirdly satisfying, and that single pass improves every routing rule, every "who approves this," and every AI answer that leans on the org chart.
4. Open your scariest folder. Pick the most sensitive thing you store (payroll, contracts, customer data) and look at who can actually reach it. Not who should. Who can.

Then put thirty minutes on the calendar, monthly, with a name attached. Not "IT." A name. The same way someone owns the bank account and someone owns the insurance renewal, someone owns the directory. When a person leaves, their accounts get turned off the same day their badge does, and it's on the offboarding checklist right next to "collect the laptop." Hygiene isn't a project you finish. It's a habit with an owner.

(One thing this isn't: a reason to panic-delete. Disable first, watch for a couple of weeks, then remove. The goal is doors you can account for, not a Monday full of "hey, I actually needed that.")

The bottom line

A clean tenant isn't the goal; it's the foundation. It shrinks the ways into your business today and decides whether the AI you turn on next quarter is brilliant or confidently wrong. The companies getting real value from these tools aren't the ones with the biggest budgets. They're the ones whose systems tell the truth.

So this week, just count the keys. If the number surprises you, that's not a crisis. That's the moment the cleanup starts. And if a conversation would help, just say the word.