Office 365 access management
Why can an ordinary account open 200,000 files nobody gave it?
Access in Microsoft 365 is assembled from direct grants, sharing links, nested groups, site inheritance and app consents, and adding them up is the hard part. In a typical tenant an ordinary user can reach hundreds of thousands of files without anyone granting that on purpose. 1Security resolves it all into one live permission graph: click a user and see every file they can open, click a file and see everyone who can open it, and revoke access in one reviewed action.
- 200,000+files an ordinary account can typically open through groups, links and inheritance
- 98%of granted permissions go unused, per Microsoft's cloud permissions research
- 10 minfrom a permission change in Microsoft 365 to the graph reflecting it, at any tenant size
The gap
A grant is easy to see. What a person can actually open is the sum of hundreds of them.
Site membership, directory groups, mailbox delegation and Teams membership each hold one piece of the answer. The join is the work.
Real access in Microsoft 365 is assembled: a direct grant here, a sharing link there, membership in a group that sits inside another group that owns a site, plus everything a consented app can touch. Ask "what can this user open?" without a graph and the honest answer is a script per site, a spreadsheet, and a result that is stale before the export finishes.
That is why access reviews take weeks and still miss the biggest holes. A reviewer looking at group membership never sees the anyone link created in 2023. A directory-based guest review does not surface SharePoint-only guests - external identities invited straight into a site that never became directory objects - and most mid-size tenants have dozens of them.
The numbers we see on first connection are consistent: an ordinary employee account reaching 100,000-300,000 files, a handful of nested groups that quietly unlock a third of the tenant, and the large majority of granted permissions never used. 1Security computes effective permissions for every identity and every resource and keeps them current, so the question stops being "export three reports and cross-reference" and becomes "click the user".
What you get
The permission graph, from a user to a single file and back.
One model covers users, guests, groups, third-party apps and AI agents on one side, and sites, files and mailboxes on the other.
Effective permissions, resolved
Multi-level nested groups, SharePoint site inheritance, sharing links and app grants flattened into what an identity can actually open - not what one screen says was configured. Files reachable is a sortable column on Users.
Walk it in both directions
Open a user: every file they can open, sorted by sensitivity. Open a file: every person, group, link, app and agent that can open it. Every hop is a real server-side filter, one click each.
The why behind every grant
Each path carries its source: direct grant, sharing link, group chain (which group inside which group), site inheritance, app consent. You see the exact path that produced the access, which is what you need to remove it without breaking something else.
Access branches with sensitive counts
The user access graph splits reach by source - OneDrive, sharing links (view, edit, review, disabled links included), files received by email, group membership - with the count of sensitive files on every branch, so you review the risky path first.
SharePoint-only guests included
External identities invited straight into a site never become directory objects and are easy to miss in a directory-based review. 1Security lists them as identities like any other, with what they can reach.
Revocation with a blast radius
Remove access resolves every grant behind a person's reach - direct, link, group, site membership - shows what each removal disconnects, removes what it safely can and asks before anything it cannot. Automated runs wait behind a 72-hour review window.
One map
Audit by clicking through, not by exporting.
The graph is not a report you generate. Every screen in the product is a view of it.
Pick a user: their groups, then the sites those groups unlock, then the files on those sites that carry sensitive data, then everyone else who can read the same files. Each hop is one click and each hop is filtered - "files this user can reach" is a real filter on the Files screen, not a spreadsheet exercise. A blast-radius question that used to be half a day of scripting is a ten-minute walk.
The same walk works for a group, a guest, an app, an AI agent or a single sharing link. When an incident names an account at 3 AM, its reach - every file, site and mailbox it could open - is a lookup, and what it actually touched sits next to it in up to three years of Activity logs.
In practice
An offboarding audit, start to finish.
The identity everyone forgets to fully close out - and the workflow that closes it.
- 01
Measure the reach
Open the leaver in Users: groups, files reachable, sharing links they created, sensitive files in reach, apps they authorised. In a typical tenant that row says 150,000 files and 30 links - the size of what one credential still opens, before you touch anything.
- 02
Revoke by source
Remove access resolves their direct grants, group memberships and site roles, shows what each removal disconnects, and stages the change. Disabling the account alone leaves group and link access in place for anyone who still holds the credential or the link.
- 03
Expire what they left behind
Sharing links the account created keep working after the account is disabled - anyone links for years. The graph lists every one; expiring them is part of the same action, not a separate hunt.
- 04
Reclaim and record
The license goes back to the pool and every step lands in Actions with the approver and the timestamp - evidence that offboarding happened, not a checklist that says it should have.
The difference
The joins only a permission graph can make.
The data behind each of these lives in a different place. The graph joins it once and keeps it joined.
- Every file a specific user can open, as one filter - resolved through groups, links and inheritance
- SharePoint-only guests: external access counted even though it lives outside the directory
- Sharing links without a password and links past their expiry date, tenant-wide, with the file and the creator
- The exact chain that produced an access: which group, inside which group, granted by whom
- Sensitive-file counts per access branch, so the risky path is reviewed first
- Apps and AI agents as identities on the same graph as people, with the same reach numbers
- A permission change reflected in about 10 minutes, at any tenant size
- The whole graph maintained at 500M+ files in production tenants
Deployment
Read-only first. First reach numbers the same day.
One read-only consent connects the tenant; no agents, no appliances, no log forwarders. Write actions are a separate opt-in consent, and every automated change waits behind a review window - 72 hours by default. Works on standard Microsoft licensing from Business Basic up: no E5, no Entra P2. Each customer's data lives in its own dedicated database, never shared across customers.
- Same dayfrom read-only consent to the first "what can this account open" answer
- 0agents, appliances or log forwarders to deploy
- Business Basicthe license floor - no E5, no Entra P2
Use cases
The questions this answers.
Before a Copilot rollout: Copilot reads exactly what each user can already reach, so "what would AI inherit" is the same lookup - per user, per site, with sensitive counts.
During an incident: an account is compromised at 3 AM. Every file, site and mailbox in its reach, and what it actually touched, is minutes of clicking, not a day of log stitching.
For the auditor: access reviews built on effective permissions instead of group listings, exportable, with a remediation trail. Least privilege becomes a number you can show, not a sentence you assert.
Microsoft 365 Audit Tool
Up to three years of activity behind every access decision - what the account did with what it could reach.
See the audit tool →Microsoft 365 Inventory Tool
Every site, OneDrive, app, agent and device the graph is built on - counted live, hidden channel sites included.
See the inventory →SharePoint Governance Tool
The resource side of the same graph: every site ranked by external exposure and abandonment.
See SharePoint governance →
FAQ
Common questions.
How is this different from Entra ID access reviews?
Entra access reviews certify group and app membership, and do that well. 1Security adds the layer underneath - effective access: what an identity can actually open once nesting, SharePoint inheritance, sharing links and app grants are added up. It also lists SharePoint-only guests, so the review covers external access that lives outside the directory.
Do we need Microsoft E5 or Entra P2?
No. The permission graph works on standard Microsoft licensing from Business Basic up. Premium SKUs matter only for optional extras such as Purview label sync or Defender alert ingestion.
Can 1Security change permissions without approval?
Not by default. The base connection is read-only. Remediation is a separately consented module, and automated actions stage proposals behind a review window - 72 hours by default, configurable to instant, 24 hours, 7 days or manual-only.
How current is the access data?
Permission changes appear in about 10 minutes regardless of tenant size. The initial full scan of a very large tenant takes longer - a million-file tenant maps in hours, 500M+ files in weeks - and the graph updates continuously from then on.
Does it cover apps and AI agents too?
Yes. Third-party apps, OAuth consents, managed identities and AI agents are identities on the same graph, with the files they can reach and the sensitive data among them counted exactly as for a user.
The 1Security platform
Office 365 Access Management is just the beginning
Office 365 Access Management is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Stop reconstructing access. Look it up.
Connect read-only and see, the same day, what your own users, guests, apps and agents can actually open - every identity, every grant, every path.
Or keep cross-referencing exports that are stale before the merge finishes.