Cleaning a retail tenant before Black Friday, not after it
Guest links, leftover contractor accounts and an IMAP leftover from a 2019 migration. We locked the tenant in three weeks so peak season was not the week identity failed.
47
Stale accounts removed
3
Weeks to lock-down
120+
Anonymous share links closed
The challenge
Head office and 18 stores shared one Microsoft 365 tenant. Seasonal contractors from the previous year still had licences. SharePoint links for planograms were set to “anyone.” IMAP was still allowed because one district manager's phone had never been replaced. Capacity and identity had not been reviewed before the holiday campaign.
What we did
We ran a licence and guest review, disabled stale accounts, turned off legacy protocols after replacing the one phone, and reset sharing defaults. Conditional access required a compliant device for staff who could change prices or payroll. Store Wi-Fi was confirmed segmented from the corporate VLAN. A short awareness session covered invoice and shipping-lure mail that hits retail in November.
The outcome
The tenant went into November with no unused contractor accounts and no anonymous planogram links. Peak-season ticket volume for “I cannot sign in” stayed inside the agreed window. The following January, the same checklist became a quarterly habit.
Let's talk about what you are running
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.