Microsoft's security team published a case last month where attackers phished their way in using a real, digitally signed remote-management installer — the same category of software your IT company uses to log into your computers.
What stuck with me is how ordinary it looked. Once that kind of access is running, it blends into normal IT activity, because it is normal IT activity. Just not yours anymore.
That's the part nobody checks when a CPA firm changes IT providers. Everyone focuses on who answers the phone Monday, where the passwords live, whether email keeps flowing. Meanwhile the old provider may still have remote agents on workstations, a delegated admin link into your Microsoft 365 tenant, an admin account nobody disabled, a backup console still pointed at your data.
None of that expires on its own.
You can check one piece of it yourself in about two minutes. Microsoft 365 admin center, Settings, Partner relationships. That page lists every IT company holding admin rights in your tenant, and you can remove those roles right there. If you see a name you stopped paying in 2023, you have your answer.
Worth an hour now, in October, rather than in February when nobody in your firm has one to spare.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email