Not Spam: It's Time to Review Microsoft 365 Access
Last year we started the Microsoft 365 Access Reviews for External Guests initiative. It is designed to help us align with audit recommendations for reviewing Microsoft 365 Teams and group members.
If you received this email, it is NOT spam. However, your caution and instinct to not click on suspicious links is a good one. This message is legitimate, part of a new process to review access of External Guests.
The goal of this initiative is to ensure that owners update access for external users on a regular basis, ensuring users external to the university who have worked or are working with the university have the appropriate access to Ohio State data.
The Access Review policy will call for all Microsoft 365 Teams and Group owners to perform an annual review of any External Guest members. We have posted instructions on the Administrative Resource Center (ARC). This process will utilize the native Microsoft access review system, so users can refer to the Microsoft 365 site for instructions detailing how to review accounts.
What to Expect
- Annual Access Review notifications started Tuesday, Nov. 1, 2022. Teams and Group owners will have 2 weeks to complete the access review. Email notifications will be sent to reviewers when an access review starts as well as a reminder halfway through the duration of the review.
- Look for email notifications from this Microsoft Azure email address: email@example.com. The subject will be “Action required: Review access to the Team/Group.” Click the Start review link to open the access review.
- The scope is users external to the university – for example users like: firstname.lastname@example.org, email@example.com or firstname.lastname@example.org. University Sponsored Guests are excluded from review, as they are considered internal accounts.
- You may also perform an access review manually at any time by signing in to the My Access portal at go.osu.edu/MicrosoftMyAccess.
- Please perform the required Access Review for your Team’s guest users, approving or denying access as appropriate. You may also consider the system recommended action generated based on the guest user's last 30 days sign-in activity. Please note:
- If a user is denied access, they are not removed immediately. They are removed from the Group/Team when the review period has ended.
- If there are multiple reviewers, the last submitted response is recorded.
If you need resources to help you use Teams more efficiently, visit the Administrative Resource Center and choose the Teams icon (university log in required). Our IT Service Desk is available to support you 24/7. Request IT support online or call the IT Service Desk at 614-688-4357 (HELP).