Microsoft Teams user onboarding
You added the new hire to five teams. What did they just get?
A new hire added to "Sales", "Projects" and "All Staff" reads as one ticket. In the tenant it is dozens of SharePoint sites, shared channels, mailboxes and years of files, granted through nesting no ticket describes. 1Security shows exactly what each team membership opens - before you add the person, on day one, and every time they move.
The problem
Onboarding hands out far more than anyone reviews.
Every team is a Microsoft 365 group, every group unlocks a SharePoint site, and every site carries years of files the new hire was never explicitly granted. Groups also sit inside other groups. A membership list shows the direct members; what adding someone to one team quietly grants - the four sites nested behind it - takes resolving the whole chain, and 1Security does that for every group. In a typical tenant, an ordinary account can reach hundreds of thousands of files through memberships nobody remembers assigning.
Then people move. A transfer adds new teams and nobody removes the old ones, so access grows with tenure. Five years in, one employee's account is worth several new hires' worth of access - and it is exactly that account a phishing attack lands on.
The fix is not slower onboarding. It is seeing what the standard memberships actually open, so the onboarding template gets right-sized once - and every later addition can be checked in seconds instead of trusted.
In practice
A new hire, checked in four steps.
What Teams onboarding looks like when a group membership shows what it really grants.
- 01
Check the team before you add anyone
Open Groups and click the team's group. The row shows direct members, total users with nesting resolved, external members, and the number of sites and files the group unlocks - 3 sites and 40,000 files is a normal answer for a department team. "If someone lands in this group, what do they get?" answered before the ticket is closed.
- 02
Verify day one
Open Users and find the new account. Its row shows files, sites, groups and apps in reach, and whether sensitive information is among them - the size of what one compromised credential would open. If a first-week account already reads like a manager's account, the template is wrong, not the hire.
- 03
Catch the creep on every move
Sort Users by files reachable and compare against role. Old memberships from previous teams surface as accounts whose reach outgrew their job - caught while the difference is one team, not four years of them. A trend policy on "files reachable per user" alerts when a single account jumps.
- 04
Right-size behind a review window
Where onboarding overshot, cleanup runs as staged proposals with a 72-hour review window. The team's owner can be asked to confirm before any membership or grant is withdrawn, and every executed change is logged in Actions.
What makes it work
Three parts of the platform behind the check.
Onboarding visibility rides on capabilities you can read about in depth.
User lifecycle
Joiners, movers and leavers with reach, activity and account state on one row - from day one to offboarding.
Explore the feature →Access management
Effective access resolved through nested groups, inherited site permissions and sharing links - what every membership really opens.
Explore the feature →Inventory
Every team, group and site as a live inventory - including the duplicate and abandoned teams that old onboarding templates left behind.
Explore the feature →
FAQ
Common questions.
Does 1Security create accounts or assign licenses?
No. Provisioning stays in Entra and your existing tooling. 1Security shows what provisioning actually granted - the sites, files and mailboxes behind the memberships - and stages cleanup where it overshot, behind a review window. It is the verification step onboarding never had.
Can we see what a single team unlocks before adding people?
Yes. Every group shows its effective membership with nesting resolved, both directions of the nesting chain, and the count of files and sites it grants access to, with sensitive information flagged - so a team used as an onboarding template can be reviewed as what it really is: an access grant.
What about guests invited into teams?
Guests go through the same resolution - including SharePoint-only guests who never became directory objects, so a review that starts from the directory alone would not have a row for them. You see what each guest can reach and when they were last active, and idle ones surface through the same filters.
Do we need E5 or Entra P2?
No. Group resolution, reach and the user lifecycle views run on standard Microsoft 365 licensing, with no agent to install and read-only access to start.
The 1Security platform
Teams Onboarding Access is just the beginning
Teams Onboarding Access is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ComplianceNIS2, DORA, GDPR, EU AI Act, SOC 2 and HIPAA as requirements with a live status, attestations, dated snapshots and evidence packs.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Onboard with your eyes open.
Connect read-only and see what your onboarding templates actually open the same day - every team, resolved to the sites and files behind it.
Or keep finding out what day one granted at year five.