Your IT person is out for two weeks. Where do the alerts go?

Three things that depend on one person

Where notices go. Every monitoring tool, backup job, and security setting was pointed at an address when someone set it up. That address may be a person, a shared mailbox, or a ticket system.

Who can sign in as an administrator. Microsoft’s emergency-access guidance names one reason for a second route into your Microsoft 365 account: the person with the most recent Global Administrator access leaves the organization. A two-week absence is a smaller version of the same problem.

Who may approve a change. If a provider needs a yes before restoring a server or locking an account, the agreement or your own list should name someone at your company who can give it while the owner is traveling.

Write each answer down with the date. A list you can hold up beside the calendar shows quickly which days have no second name on it.

Checks you can make today

1. Ask for a written list of every report and alert that goes to a person: what it covers, the address it goes to, and the name of a second person who reads it. Each line needs two names.
2. Look at each address on the list. If it is one person’s mailbox, send it a note and see whether an automatic reply comes back.
3. Sign in to the Microsoft 365 admin center, open Roles, then Role assignments, then Global Administrator. Count the names and mark each one: an employee, a person at your provider, or someone you do not recognize. Microsoft recommends fewer than five Global Administrators.
4. Open Settings, then Partner relationships. Each provider with access to your account is listed with the role it holds.
5. Find the sentences in your agreement about incident notice. CISA’s guidance to customers of managed service providers says contracts should detail how and when the provider tells you about an incident affecting your environment.
6. Find the sentences that say who owns detection and who owns response. The same CISA advisory asks that contracts state whether the provider or the customer owns specific responsibilities, such as hardening, detection, and incident response.
7. Ask how long the provider keeps the logs from your systems. CISA advises organizations to store their most important logs for at least six months.

What a gap looks like

• The only address on an alert list is one person’s mailbox.
• One name holds the only administrator sign-in.
• The agreement says the provider will notify you, and does not say how, when, or whom.
• The phone number you would call is answered by the person who is away.
• No one at your company is named as able to approve urgent work.

Ask for one test

A list of names tells you who is supposed to see an alert. It does not show that anyone has. The check that does is a dated one: ask the provider to send a test alert to the full list, then note who answered and how long it took. Write the date next to it. Repeat it after any staffing change, because Microsoft’s own emergency-access guidance asks for a review whenever there is a recent change in IT staff.

What a clean result covers

Planned absences are the easy case, because you can run these checks beforehand. The same list also covers the unplanned ones: an illness, a resignation, or a provider whose main contact changes jobs.

If every line has two names and the test alert reached both, you know the list works on the day you tested it. It does not tell you what the tools are watching for, or whether a given alert is set up at all. Those are separate questions about the tools, and they sit with the person who configured them.

We look at the list with you, compare it to the roles in your admin center, and tell you what we found and what we did not, with dates. A person reads the result.

A tool that sends every message to one inbox is only as watchful as that person’s calendar.

Related

• Who Holds Your Administrator Passwords: Six Places to Look
• Questions to Ask Your IT Provider About Backups
• How to Bring a Security Concern to the Owner
• What a Second Opinion on Your Security Covers

Sources

• Microsoft Learn: About administrator roles in the Microsoft 365 admin center
• Microsoft Learn: Manage emergency access admin accounts
• Microsoft Learn: Best practices for administrator roles
• Microsoft Learn: Review cloud solution provider (partner) admin privileges
• CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)
• CISA: Cyber Essentials