Management wants a fast cleanup of generic M365 mailboxes that still have sign-in enabled. I’m mostly working on it alone, and the undocumented dependencies make it hard to know what’s safe to change.
How would you check for dependencies, and how would you handle the deadline pressure without causing an outage?
Start with an inventory of the candidate accounts. Check sign-in history and mailbox delegation, then ask department stakeholders what each account is used for. Look for applications and processes as well as people who use the mailbox.
Where sign-in appears unnecessary, consider disabling it first and keeping a clear way to restore access. Agree on an observation period based on when dependent processes might run. A quiet week does not prove an account is unused if something only runs monthly. Conversion to a shared mailbox can be a separate decision once the use is understood.
Put the tradeoff in front of management in writing. Give them a list of accounts, the checks you can complete, an estimate for each phase, and the possible impact of skipping those checks. Ask them to approve the priorities and the risk before changes start.
That turns the deadline into a decision they can make with the consequences visible, rather than a promise that nothing will break.
Get each department to review its list and name a stakeholder who can identify what is still needed. Set a response date, explain what will happen after it, and communicate the planned changes to potentially affected staff.
In a legal environment, involve the appropriate legal team too. They can help identify accounts that need special consideration before you change anything.
q.418+plumbob_6:
A missing response is still not proof that an account has no dependencies. Treat it as part of the risk decision, not a substitute for checking.
Do it in phases instead of treating the whole environment as one big switch. Prioritize with management, make sure backups are available, and keep changes small enough that you can investigate and reverse them if something stops working.
There is a tradeoff here. Leaving sign-in enabled has its own risk, while disabling it without enough investigation can interrupt a process. Those risks deserve to be discussed together.
Also, one person cannot make an understaffed project magically fit an unrealistic schedule. Give an honest estimate, do the work you can during your working hours, and keep management informed about what remains. They can change the scope, staffing, deadline, or risk they are willing to accept.
Answers are reviewed before publication.
Javlor-5x:
Make sure the affected teams know what is changing and how to report a problem. A rollback plan only helps if someone notices and reports the breakage.