Microsoft 365 remediation automation
12,000 overshared files is not a report. It is a backlog. We clear it.
Every scan of a Microsoft 365 tenant ends the same way: thousands of anyone links on sensitive files, hundreds of dormant accounts with licenses, dozens of sites Copilot should not read. 1Security turns each finding into an automation that counts its matches live, stages a proposal per resource behind a 72-hour review window, and executes as a native Microsoft change - reversible, logged, never behind your back.
- 26suggested automations in 13 groups, each already counted against your live tenant before you enable anything
- 72 hdefault review window before a proposal executes; instant, 24 hours and 7 days are the other presets
- 0shadow permissions - every action is a real Microsoft operation, visible and reversible in the admin centers
The problem
Findings pile up faster than anyone can fix them.
A report listing 12,000 overshared files is not a result. It is a month of admin work with a chart on top.
The manual path is a month of clicking through SharePoint permissions or a script nobody wants to own. Both fail the same way: the tenant drifts back within a quarter, and the second cleanup costs as much as the first because nothing about the process was durable. Most tenants we connect to have been "cleaned up" before - and still carry thousands of anyone links.
The automated path fails differently. Teams do not switch remediation on because they cannot see what it would touch, and a tool that acts on the tenant without showing its blast radius first is not a tool anyone sensible enables. The missing piece is the preview: the 4,000 resources a rule would change tomorrow morning, counted before anything runs.
So the design here is: count first, show the actual resources, then act with a clock and a human veto in the middle. The default is progress; your attention goes to the exceptions.
What you get
Counted, previewed, then executed.
An automation is a policy plus an action - the same policy engine that powers Trends, with something to do about what it matches.
Suggestions with live counts
Every suggested automation on the Automations board shows how many resources in your tenant match right now - "remove anyone links from sensitive files: 3,412" - evaluated by the real engine against your live permission graph, not estimated.
Counted, never executed
Until you explicitly enable one, a suggestion is a read-only measurement. It raises no alert, sends no mail and performs no action. Evaluate opens the exact list of resources behind the number.
The review window
An enabled automation stages a proposal per resource and starts a countdown - 72 hours by default. Approve executes now, reject snoozes it for 30 days, withdraw clears it from this run, and doing nothing lets it proceed when the clock runs out.
Actions across every resource type
Sites, files, users, groups, apps, devices, email and licenses: remove a link scope, make a site private, expire external access, disable an inactive account, reclaim its license, block Copilot indexing on a site.
Composite actions that understand the graph
Revoking a user's access resolves every path it arrives through - direct, link, group, site - removes what it safely can, and asks for confirmation on the paths whose removal would affect other people, with the blast radius shown per source.
A ledger you can hand to an auditor
Runs, actions fired, resources remediated in the last 30 days, and a per-resource record of every change in Actions - manual and policy runs in the same list, with who approved what and when.
How deep it goes
The review queue is where the trust is built.
A proposal carries the resource it targets, the policy that proposed it, the action and its arguments, and a live countdown.
Approve executes now without waiting out the window. Reject means "never do this to this resource" and snoozes it - 30 days by default - so the policy cannot re-propose the same fix tomorrow. Withdraw drops it from this run only; the policy will propose it again within minutes, so it clears the queue rather than saying no.
Doing nothing is the interesting one. When the window elapses the action proceeds, which is the whole point of a review window: the default is progress, and your attention is only needed for exceptions. If that is too much for a given policy, set it to manual approval and the window never auto-releases.
Bulk review applies decisions by match rather than by a frozen list of ids, so the proposals that arrive while you are reading a filtered slice of the queue are included instead of silently skipped. That detail matters the first time you approve 2,000 rows on a tenant where the engine re-evaluates every few minutes.
In practice
The safe first automation.
There is a rollout pattern that consistently works, and it starts smaller than people expect.
- 01
Pick the largest count you already agree with
Usually "remove organization-wide links from files with sensitive information" - in a mid-size tenant a count in the thousands. You are not deciding whether it is right, only whether the engine picks the right rows.
- 02
Enable with a 72-hour window and manual approval
Nothing auto-releases. For the first week you are reviewing a queue rather than watching a tenant: open Evaluate, spot-check twenty rows, approve the slice.
- 03
Wait until the proposals stop surprising you
That is the real acceptance test. It usually takes days rather than weeks, because the same kinds of rows keep arriving and every one you approve is logged in Actions.
- 04
Switch approval to automatic, keep the window
Now the loop runs itself - a site that drifts back to anyone links is fixed again within minutes of the audit event - and you can still veto anything for 72 hours.
How it works with Microsoft
No shadow permission model.
Every action is a native Microsoft operation, so nothing here is a parallel state you have to reconcile later.
- Disabling an account sets accountEnabled to false in Entra - reversible from the Entra admin center
- Removing a link is a SharePoint link removal, not a suppression in our database
- Blocking Copilot indexing sets the site's own restricted-search setting
- Anything an admin changes in the Microsoft portals is picked up by the next evaluation, within minutes
- Write access is a second, explicitly consented application - the read-only app cannot change anything
- Detection, counting and previews run on Business Basic; only execution needs the write consent
- Actions Microsoft restricts stay restricted - device enable and disable is Windows-only, as Microsoft requires
- Discovery-only resources with no Entra object, such as shadow devices, are filtered out at match time rather than failing at execution
Evidence
A remediation engine that proves it is running.
The Automations screen reports active automations, runs and resources remediated over the last 30 days, plus a liveness strip - "engine live, last evaluation 3 minutes ago" - and an actions chart from one hour to one year, click-through to the exact resources changed. A remediation product that cannot prove it is running is asking for a lot of faith.
- 4themes: AI safety, oversharing, hygiene and cost
- Minutesfrom an audit-log change to the affected policies being re-evaluated and new proposals staged
- 30 daysof runs and resources remediated on the counters, with a per-resource ledger behind them
Related
Where this fits.
Automations consume findings. The screens that produce them are the ones worth pairing this with - and Copilot readiness is the single most common reason teams enable their first automation.
File permissions
Where most remediation targets come from: files with anyone or org-wide links on sensitive content.
See files →Copilot security
The readiness work automations are most often enabled for: block indexing on the sites Copilot should not read.
See Copilot →License optimization
The cost half of the catalog: reclaim paid seats from accounts with no sign-in for 90 days.
See licenses →
FAQ
Common questions.
Can it change my tenant without me enabling anything?
No. The read-only application physically cannot write. Remediation requires a second application with its own explicit consent, and until that is connected the screen counts and previews while every action stays unavailable.
What exactly does "Evaluate" show me?
The real resources behind the count, with a switcher between the policies in the group, the conditions each one uses, and the arguments the action would run with. Suggestions whose defaults are illustrative - an allowed-domains list, an owner to assign - are flagged and left unchecked, so nothing ships with example data in it.
What happens if I do nothing during the review window?
The action proceeds. That is the design: the default is progress, so your attention goes to the exceptions rather than to approving the obvious. Set the policy to manual approval if you want the opposite.
Can I customize a suggested automation?
Yes. Review and customize opens the policy in the editor, where conditions, arguments, name and severity can be changed before it ever runs. The edit is kept for your tenant and survives future catalog updates.
Do manual actions and automations share a record?
Yes. The same action catalog powers both - select rows on any list and run an action by hand - and manual runs land in the same Actions ledger as policy runs, so who changed what is one story rather than two systems to cross-reference.
See what the fixes would touch. Then decide.
Read-only consent counts every suggestion against your live tenant the same day - "3,412 anyone links on sensitive files" is a number you will have before lunch. Acting on it comes later, behind a separate consent and a review window.
Or run the cleanup script again next quarter.