Clients/Northwind Traders

Northwind Traders

northwindtraders.onmicrosoft.com

Monthly review

Users/

Ann Patel

ann.patel@northwindtraders.example

MemberSign-in allowedCloud-onlyAdmin

Download PDF XLSX

Leaving? Show what to tidy up

Needs attention

Worst: high

Sign-in

Allowed

Last sign-in 11 days ago

MFA

Protected

Admin roles

Global Administrator and 1 more

Licences

1 licence

£18.10 a month

Devices

2 devices

Needs attention

high
The mailbox forwards all mail to ann.patel@homemail.example, outside the organisation.
Details
high
Inbox rule ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank.
Details
high
Inbox rule "Copy to home": Forwards to ann.patel.home@homemail.example.
Details
high
Shares 1 item from OneDrive with anyone who has the link.
Details
medium
Admin without a phishing-resistant method: register a passkey or security key. A fake sign-in page can relay codes and push approvals.
Details
medium
Gave Mail Sync Pro access to Mail.Read. Check it's an app the business uses.
Details
medium
Signed in from FR, which this tenant rarely signs in from. Check the person was there.
Details
medium
Signed in 2 times with only a password in the last 7 days.
Details
low
Microsoft 365 Business Premium is assigned directly and by All Staff, so taking them out of the group won't remove it.
Details
low
Microsoft 365 Business Premium: Exchange Online (Plan 2). Only used email in the last 30 days. Saves £11.50 a month.
Details

Open findings

All findings

high
No inbox rules hide mail
".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank · since 6 Sep 2026
high
No mail is forwarded outside the organisation
Mailbox forwarding to ann.patel@homemail.example (keeps a copy) · since 6 Sep 2026
high
No mail is forwarded outside the organisation
Inbox rule "Copy to home" forwards to ann.patel.home@homemail.example · since 6 Sep 2026
medium
Admins use phishing-resistant sign-in methods
Global Administrator; signs in with Authenticator app · since 6 Sep 2026
low
No account reports to a blocked manager
Reports to Robert Hughes, whose sign-in is blocked · since 6 Sep 2026

Licences

1 licence, £18.10 a month

Usage location: GB

Licences 1

Licence	Assigned	Cost / month
Microsoft 365 Business Premium	Directly and by group: All Staff	£18.10

Microsoft 365 use

Email: Used (last 10 Oct 2026)
Teams: Not in the last 30 days
OneDrive: Not in the last 30 days
SharePoint: Not in the last 30 days
Office apps: Used (last 10 Oct 2026)
Office apps used on: Web
Email in 30 days: 40 sent, 300 received

Cheaper licence options 1

Licence	Option	Why	Saving / month
Microsoft 365 Business Premium	Exchange Online (Plan 2)	Only used email in the last 30 days. It also includes Intune, Entra ID P1 and Defender, which an Exchange Online plan doesn't. Check the account doesn't rely on them.	£11.50

From Microsoft's usage reports, which run a couple of days behind (as of 9 Oct 2026).

MFA and sign-in protection

Protected

MFA set up: Yes
Methods: Authenticator app
Phishing-resistant method: No
Strongest method: Authenticator app or token
Asked for first: Authenticator app
Can sign in without a password: No
Can reset their own password: Yes
MFA required by: Require MFA for all users
Conditional Access policies that apply: Require MFA for all users
Legacy sign-in blocked: No

Admin roles

Global Administrator and 1 more

Role	How assigned	Scope	Privileged
Global Administrator	Active	Whole directory	Yes
Groups Administrator	Active	Limited scope	No

Administrative units

Administers 1, In 1

Unit	Relationship	Membership	Restricted
Sales	Administers as Groups Administrator	Assigned	No
Sales	Member	Assigned	No

Teams and groups

Owner of 4, member of 4

Name	Type	Role	Note
Board	Team	Owner	Only owner
Clients	Team	Owner
Sales	Team	Owner
Finance	Microsoft 365 group	Owner
Operations	Team	Member
Marketing	Microsoft 365 group	Member
Marketing	Microsoft 365 group	Member
Provisioned	Microsoft 365 group	Member

Members are read for teams, Microsoft 365 groups and groups used by Conditional Access. For other security groups and distribution lists only owners show.

Mailbox

Forwards outside

Address: ann.patel@northwindtraders.example
Type: User
Size: 7.3 GB of 49.5 GB (15%)
Archive: On
Litigation hold: Off
Forwarding: ann.patel@homemail.example (outside the organisation)
Older protocols allowed: None
More: Everything about this mailbox

Inbox rules 2

Rule	Enabled	What it does	Why it stands out
.	Yes	body has invoice, payment: move to RSS Feeds; mark as read; stop processing rules	Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank
Copy to home	Yes	All messages: forward to ann.patel.home@homemail.example	Forwards to ann.patel.home@homemail.example

Mailboxes this person can open or send from 3

Mailbox	Type	Access
accounts@northwindtraders.example	Shared	Full access, Send as
info@northwindtraders.example	Shared	Full access, Send as, Send on behalf
reception@northwindtraders.example	Shared	Full access, Send as

Devices

2 devices

Device	Operating system	Compliance	Encrypted	Last check-in	Problems
Ann Patel's iPhone	iOS 18.6	Compliant		Today
LAPTOP-PATEL	Windows 11 25H2 (10.0.26200.6584)	Compliant	Yes	Yesterday

OneDrive

Shared with anyone

Storage used: 53.4 GB of 1.00 TB
Files: 50
Files active in the last 30 days: 5
Last activity: 9 Oct 2026

Shared from this OneDrive 1

File or folder	Shared with	Can edit	Link expires
holiday.jpg	Anyone with the link	No	1 Jan 2099

Apps this person allowed

1 app

App	Publisher	Permissions	From
Mail Sync Pro	Unknown Ltd (unverified)	Mail.Read, offline_access	Third party

Recent sign-ins

39 sign-ins, 3 failed

Successful: 34 (32 with MFA, 2 with only a password)
Failed: 3 (3 wrong password, from 3 addresses)
MFA and other prompts: 2
Last failure: 8 Oct 2026 (3 days ago): Wrong user name or password
Countries: GB, FR (unusual for this tenant), RU, BR
Apps: Microsoft Teams, Office 365 Exchange Online, Office 365 SharePoint Online, Azure Portal, Unknown app
Devices: Windows10
Addresses that failed: 203.0.113.42, 198.51.100.9, 203.0.113.66

Where this account signed in 4

Country	Successful	Failed	Cities	IP addresses	Last success (UTC)
GB	33	1	London	192.0.2.10, 203.0.113.42	10 Oct 2026, 16:15
FR	1	0	Paris	198.51.100.40	8 Oct 2026, 21:40
BR	0	1	Sao Paulo	203.0.113.66
RU	0	1		198.51.100.9

Why sign-ins failed 1

Error code	What it means	Sign-ins
50126	Wrong user name or password	3

Interactive sign-ins in the last 7 days from the Entra ID sign-in log. MFA and other prompts aren't counted as failures.

Sign-in history

Signed in on 20 days of the last 30

History from: 13 Jun 2026
Last sign-in: 10 Oct 2026 (yesterday)
Countries: BR, FR, GB, IE, RU, US

Sign-ins by month 5

Month	Days	Successful	Failed	With MFA	Password only	Countries
Oct 2026	7	39	3	35	4	BR, FR, GB, IE, RU
Sep 2026	20	41	0	30	11	GB, IE
Aug 2026	19	40	1	31	9	FR, GB, IE
Jul 2026	23	51	2	27	24	FR, GB, US
Jun 2026	12	28	0	19	9	FR, GB, IE, US

Every interactive sign-in since 13 Jun 2026, from the activity history's daily summaries, kept as long as Data retention says (25 months by default).

Sign-ins and admin changes

11 days ago

Last interactive sign-in: 30 Sep 2026 (11 days ago)
Last background sign-in: None recorded
Last successful sign-in: None recorded

Legacy sign-ins in the last 30 days 1

Client	Succeeded	Failed	Last attempt	Countries
IMAP4	0	1	7 Oct 2026 (4 days ago)	RU

Admin changes in the last 120 days 3

When (UTC)	Change	By	Target	Detail
8 Oct 2026, 20:31	Add eligible member to role in PIM completed (permanent)	admin@northwindtraders.example	ann.patel@northwindtraders.example	Exchange Administrator
8 Oct 2026, 08:31	Reset user password	admin@northwindtraders.example	ann.patel@northwindtraders.example
7 Oct 2026, 08:31	Admin registered security info	admin@northwindtraders.example	ann.patel@northwindtraders.example

Office Sentry keeps this tenant's sign-in log from 13 Jun 2026: each day is under Sign-in history, and the last week in detail under Recent sign-ins. Legacy sign-ins and the last sign-in dates show here.

Timeline

13 events

When	Area	What happened
8 Oct 2026, 21:40 UTC	Sign-in	Signed in from FR, unusual for this tenant (198.51.100.40)
8 Oct 2026, 20:31 UTC	Admin change	Add eligible member to role in PIM completed (permanent): Exchange Administrator (by admin@northwindtraders.example)
8 Oct 2026, 16:07 UTC	Sign-in	Last of 3 failed sign-ins: Wrong user name or password
8 Oct 2026, 08:31 UTC	Admin change	Reset user password (by admin@northwindtraders.example)
7 Oct 2026, 08:31 UTC	Admin change	Admin registered security info (by admin@northwindtraders.example)
7 Oct 2026, 03:00 UTC	Sign-in	Legacy sign-in with IMAP4: 0 succeeded, 1 failed
On or before 6 Sep 2026	Mailbox	Inbox rule "." first seen: Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank
On or before 6 Sep 2026	Mailbox	Inbox rule "Copy to home" first seen: Forwards to ann.patel.home@homemail.example
On or before 6 Sep 2026	Mailbox	Forwarding to ann.patel@homemail.example first seen (outside the organisation)
On or before 6 Sep 2026	Apps	Allowed Mail Sync Pro (Mail.Read, offline_access)
On or before 6 Sep 2026	MFA	Authenticator app first seen as an MFA method
On or before 6 Sep 2026	Admin roles	Global Administrator role first seen
On or before 6 Sep 2026	Admin roles	Groups Administrator role first seen

Newest first, the last 90 days (up to 50 events). Admin changes and sign-ins keep their own time; rules, forwarding, app consents, MFA methods and roles are dated when Office Sentry first collected them, so they were set up on or before that day.

History

No changes spotted since 6 Sep 2026.

Found by comparing collections since 6 Sep 2026. The date is when Office Sentry first saw the change.

Data from Users (3 hours ago), MFA registration (3 hours ago), Conditional Access (3 hours ago), Admin roles (3 hours ago), Groups and Teams (3 hours ago), Mailboxes (3 hours ago), Inbox rules (3 hours ago), Mailbox size (3 hours ago), Devices (3 hours ago), SharePoint and OneDrive usage (3 hours ago), Shared files (3 hours ago), Apps and consents (3 hours ago), Legacy sign-ins (3 hours ago), Sign-in activity (3 hours ago), Admin activity (3 hours ago).