Forum Discussion
Former short-term employee added as Billing Admin
Hi everyone, I’m hoping to get some insight into how this could have occurred and what we should review to prevent it from happening again. We are a small organization, and we recently discov...
A Former short-term employee could appear as a Billing Administrator in Microsoft 365 if the role was explicitly assigned, inherited through Global Admin privileges, or granted via a Cloud Solution Provider (CSP) partner relationship. To prevent recurrence, you should audit admin role assignments, review partner access, and enforce strict least-privilege and MFA policies.
https://learn.microsoft.com/en-us/purview/audit-log-activities
https://learn.microsoft.com/en-us/microsoft-365/admin/misc/add-partner?view=o365-worldwide