Microsoft 365 lifecycle management
Half of your tenant is abandoned. Do you know which half?
In a typical Microsoft 365 tenant, more than half of all files sit in sites nobody has opened in a year, hundreds of licensed accounts have not signed in for months, and dozens of paid apps have no users left. 1Security lists every one of them, ranks them by cost and exposure, and cleans up behind a review window - so lifecycle management stops depending on someone remembering.
The problem
Everything in Microsoft 365 gets created. Almost nothing gets deleted.
A project ends and its Teams site stays. A contractor leaves and their guest account stays. Someone trials an app for a week and its consent stays for years. Microsoft 365 has an owner for every "create" and nobody for "delete", so the tenant only ever grows. Most tenants hold several times more sites than IT believes they have.
The numbers we see on the first day of a new connection are remarkably consistent: more than half of all files sitting in sites with no activity for a year, 10-30% of paid licenses on accounts that have not signed in for months, dozens of consented apps with zero users, and terabytes on SharePoint sites nobody remembers creating.
Clutter alone would be fine. The problem is that abandoned things keep their permissions. The site nobody has opened since 2024 still has external users. The dormant account still reaches thousands of files. The dead group still unlocks a mailbox. Nobody would defend that access - and nobody is looking at it either.
In practice
From "we should clean up someday" to a list you can act on today.
How a lifecycle pass runs in 1Security - no scripts, no CSV exports, no guessing.
- 01
See what is abandoned, per resource type
Open Sites and filter to no activity in a year. Open Users and filter to no sign-in for 90 days with a license attached. Open Apps and filter to zero active users. Open Groups and filter to no owner or no members. Every list is live and every filter is one click - the same orphaned indicators exist for sites, groups, users, guests, apps, AI agents, devices and licenses.
- 02
Sort by what it still costs - or still exposes
Storage in TB, paid seats per month, external users, sensitive files in reach: each is a column. Sort by any of them and the top of the list is where cleanup pays first - the 4 TB archive site with anyone links, the 200 dormant accounts still on E3, the 40 paid apps nobody has opened this year.
- 03
Clean up behind a review window
Enable a suggested automation - archive dormant sites, remove idle guests, reclaim unused licenses - and 1Security stages a proposal for every matching resource. 72 hours to review by default, owners can be asked to confirm, and rejecting a proposal snoozes it. Nothing disappears silently.
- 04
Show the result in numbers
Storage reclaimed, licenses returned to the pool, external access removed, sites archived - every executed action is logged in one place. Your quarterly review opens with "we reclaimed 11 TB and 180 licenses", not with a promise to look into it.
What makes it work
Three parts of the platform, one cleanup pass.
Lifecycle management in 1Security is not a separate module. It runs on the same live inventory, user lifecycle and site governance you can read about in depth.
Inventory
Every site, OneDrive, group, user, guest, app, AI agent, device and license in one live inventory - with abandoned and orphaned filters on each list.
Explore the feature →User lifecycle
Joiners, movers, leavers and the dormant accounts in between - access, sharing links and licenses handled as one flow.
Explore the feature →SharePoint governance
Sites ranked by size, silence and exposure, with staged site-level automations for sharing, ownership and archival.
Explore the feature →
FAQ
Common questions.
Will it delete something someone still needs?
Not without a human seeing it first. Every proposal waits in a review window - 72 hours by default, configurable all the way to manual approval only - and can be routed to the site or group owner to confirm. Rejecting a proposal snoozes it. Every executed action is logged with who approved it and when.
How much do tenants typically find?
Enough to matter on day one. It is common to see more than half of all files in sites with no activity for a year, 10-30% of paid licenses on dormant accounts, dozens of consented apps with no users, and single sites holding terabytes nobody has opened. Your own numbers appear the same day you connect.
Do we need to grant write permissions to start?
No. The base connection is read-only, and every suggested cleanup shows its live match count before you grant anything. Write actions are a separate module you approve only when you decide to let 1Security act - and even then every action passes through the review window.
Does this need E5 or an extra Microsoft license?
No. It runs on standard Microsoft 365 licensing, with no agent to install and no E5 requirement.
The 1Security platform
Microsoft 365 Lifecycle Management is just the beginning
Microsoft 365 Lifecycle Management is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Anomalies and detectionsSpikes in sharing, downloads, sign-ins, consent and agent activity, scored against each tenant’s own pattern, with curated response actions.
- Permissions and sharingWho can reach what, through which group, link or guest, and whether anyone meant it. The sharing map every audit asks for.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
See what your tenant is still paying for.
Connect read-only and get your abandoned sites, dormant accounts and unused licenses listed the same day. Then decide what to clean up, with a review window in front of every action.
Or keep paying for what nobody uses.