The challenge
The firm had Microsoft 365 and an external IT provider, but several staff accounts were exempt from multi-factor authentication. A former employee also retained access to the accounting system after their Microsoft 365 account had been disabled.
What the audit found
MFA exemptions
Exemptions configured under the previous provider left some users without MFA. The directors did not know those gaps existed. The finding showed why a general assurance that MFA is enabled needs to be checked against actual account coverage.
Independent application access
The former employee's Xero login was separate from Microsoft 365. Disabling email access had not removed access to the accounting application. The offboarding process did not cover that separate identity.
What Novaguard changed
- Removed MFA exemptions and addressed user-specific difficulties with authentication.
- Audited existing application access and revoked outdated accounts.
- Consolidated application identities where supported.
- Documented controls and any necessary exceptions with ownership and review requirements.
- Updated offboarding to account for integrated and independent applications.
Results and verification
The identified MFA gaps and former employee access were closed. This engagement addressed findings from an onboarding audit; it was not a breach response, and no insurance claim occurred.
The lesson is about checking deployed controls and application access. It does not establish how an insurer would decide a hypothetical claim.
What this means for a similar organisation
Review the users covered by authentication policies and the applications included in offboarding. Applications outside the central identity platform still need an explicit owner and removal process.
A Cyber Business Review can examine these controls without requiring a provider change.