Final admin access audit before exit
Overview
Last step before disabling MSP access: prove no lingering backdoors—protects both parties legally.
Scope
Cloud admin roles, VPN, firewall, hypervisor, iLO/iDRAC, database sa, third-party SaaS admin invites.
Method
Export role assignments JSON; compare against expected list; signoff by two eyes internal.
Passwords
Rotate known shared secrets client will keep—toss MSP memorized passwords—even if awkward conversation.
Keys
SSH authorized_keys, API tokens, S2S app secrets in Entra—purge MSP-related entries explicitly named.
Logging
AAD audit / CloudTrail snapshot after removal showing no MSP identity activity attempts post-cut.
Deliverable
PDF checklist client CISO initials; store 7 years per your record policy.
If findings
Delay cutover hours, not days—fix rogue account before press goes out “we’ve transitioned.”
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...