A seven-step method for finding and removing access your team no longer needs, using nothing more than a spreadsheet.
Least privilege means everyone has the access their job needs, and nothing extra. Access tends to grow quietly: a temporary permission that was never removed, a former contractor still on the list, an admin account used for email. A review cuts it back. Here’s how to run one in an afternoon.
What you need
- A spreadsheet
- Admin access to your main systems, or someone who has it
- A list of current staff and contractors
- Two to four uninterrupted hours
Step 1: List the systems
One row per system that matters: email and file storage, accounting, customer records, website admin, domain registrar, remote desktop or VPN, firewall or router admin. If losing it or leaking it would hurt, it goes on the list.
Step 2: Export who has access
For each system, pull the user list and their role. Most cloud services can export this. Paste it into the sheet next to the system name. Mark which accounts are administrators.
Step 3: Match against reality
Compare each account with your current people list. Flag:
- Accounts belonging to people who have left
- Shared or generic logins such as “office” or “admin”
- Admin rights held by people who don’t administer anything
- Accounts without MFA
- Contractors whose work has finished
Step 4: Ask one question per flag
For each flagged account: does this person need this access to do their job this month? If yes, keep it and note why. If no, remove or reduce it. If nobody knows, disable it rather than delete it. Someone will speak up if it was needed, and you can restore it.
Step 5: Separate admin from daily use
People who genuinely need admin rights should use a separate admin account for admin tasks, and a normal account for email and browsing. That way a phishing link opened from the inbox doesn’t land with full control.
Step 6: Fix the shared logins
Shared accounts make it impossible to know who did what, and the password never really gets changed when someone leaves. Replace them with named accounts where the system allows it. Where it doesn’t, store the credential in a password manager and change it whenever someone with access leaves.
Step 7: Put the next review on the calendar
Quarterly works for most small teams. Also review whenever someone leaves or changes role. Keep the spreadsheet; next time will be much faster.
Beyond the review
A review cleans up the past. Per-app access with MFA and device checks keeps things clean going forward, because access is granted narrowly from the start. For outside help, follow our contractor access rules.
See how it fits together on the remote access page.