Harm, not hygiene

You can now see more open rows than a quarter can close. That surplus is the moment programmes become tidy. They disable stale guests, fill in description fields, chase multi-factor enrolment, harvest unused licences, and report the activity as risk reduction. Some of it is worth doing. None of it answers which verb, if abused tomorrow, would change other people's access, take money, stop production, or empty a secret store. The order of work is harm. Hygiene can have the leftover capacity. It does not get the first close.

Hygiene has a look, and harm has a verb

Hygiene is a property of the catalogue. It is manageable, assignable, and visible in the tools you already pay for, which is why it wins planning meetings. A team can finish a hygiene sprint and show a cleaner export. The estate that can act may be the same estate, because the wide verb was never in the export that got cleaned.

Harm is a property of the verb on the Monday table. It is what becomes possible if that verb is used against you, or used clumsily, or used by someone who should not have it. Reset authentication methods for other users. Grant a directory role. Deploy to production. Pull a secret that decrypts customer data. Approve a payment run. Change a Conditional Access policy. Disable the audit stream. Those are not a maturity ladder. They are actions. If the verb column still says "contributor" or "admin", you cannot rank harm. You can only rank how frightening the label sounds.

A blanket "over-privileged" flag on an application is hygiene with a severe adjective. It feels like ranking. It is a category. Your ranking starts when one application's verb is "read one storage account" and another's is "grant roles in the tenant", and you refuse to let a single tag put them in the same pile.

Standing multiplies harm. It does not define it. A standing narrow verb can outrank a requested wide verb if the window is short, watched, and actually ends. A standing wide verb outranks almost every hygiene task you could name. Break-glass that is usable every day is standing harm with a procedure next to it. An eligible role nobody has activated is not can this morning. If the same person can activate it alone, that is standing access with a form. When you mark harm, write the state beside it. A ranking that ignores state will prefer dramatic role names over quiet standing secrets.

Notice is part of harm, and it is easy to fake. "We would see it in the vault session recording" is notice after a checkout, and only if the path used the vault. A client secret that never checks out is use without that notice. "The SIEM would alert" is notice if the alert exists, someone reads it, and the action is one the log can see. Many grants are used as themselves, successfully, and the log of a successful legitimate-looking call is not an alert. Do not give notice credit for a log you have not tested against the verb. Untested notice is not a control on the verb. Harm does not shrink because a log pipeline exists.

Questions, asked of a verb

You still do not need a score. Instinct fills a grid from familiarity, and familiarity rates the known system as safe. The grid would look objective because it had numbers. Ask a short set of questions in prose, of the wide rows only, and write the answers in sentences. Sentences are harder to average into a heat map. That difficulty is the point. Ban the colour. If a sponsor needs a colour to attend, the short list is the only mark. Everything else is unscored. Unscored does not mean safe.

What does this verb change if it is used badly. Stay concrete. A reset of authentication methods changes who can sign in as someone else. A mail read at tenant scope changes what the holder can know. A pipeline deploy changes what production runs. A role-grant changes every other answer in the table, which is why it sits at the top more often than people who live in data classification expect. Data classification workshops will tell you the customer table is the crown jewel and will never mention the role that can add a member to the group that can read it. The jewel is downstream.

Who else does it reach. One application, one subscription, one user, or the tenant, the domain, the payment system. Reach is why a wide directory verb often outranks a local admin on a forgotten appliance, and also why that local admin sometimes does not, if the appliance is the payment system. The resource column is the reach. A verb with no resource, or with "environment" as the resource, is not ready to rank. Send it back rather than giving it a middle rank to keep the conversation moving.

Would you know, in time to matter. In time means before the verb has finished its damage, not before the quarterly review. A standing client secret with application permissions will have finished before a campaign reviewer is involved. A requested elevation that pages a second person may not. Write the honest answer. Unknown notice is allowed. Invented notice is not.

Is there a second object that keeps the verb alive if you remove the one you have noticed. A wide verb with two objects is more harmful to ignore than a wide verb with one, because the first close will feel done and will not be. Rank the verb once, and attach every object. Do not rank the objects as if they were separate risks that can be sequenced around a team boundary. The vault team takes the password, the directory team leaves the role, and the verb remains. That split is an ownership convenience. Harm does not respect it.

Is the who-cell empty. An empty owner does not make the verb wider. It makes it less likely anyone will notice it being used, and less likely a review will have asked whether it should exist. Move it up in the ordering when the verb is already wide. Do not move a harmless orphan above a narrow, owned, standing admin on a payment system just because emptiness feels like a finding. Harm is a different axis. A row can be orphaned and harmless. A row can be owned and catastrophic. Say both words. Do not add them into a single score that hides the disagreement.

You will be invited to a crown-jewel workshop instead of this. The workshop draws the network, colours the important boxes, and produces a list of systems. The diagram does not get to rank harm. A jewel with no identity list is a picture. A dull system with a standing role-grant is a verb. If the workshop cannot be avoided, insist that every jewel name a verb and an object before it is allowed to outrank the rows you already have. A jewel that cannot name them is a hypothesis. Hypotheses do not get the first close.

What orphan cleanup usually cleans

When a steering committee hears "orphan", the project that arrives disables directory accounts with no manager, deletes quiet guests, and harvests licences. The count was taken inside the directory's idea of an account. Service principals, local administrators, and secrets in repositories are untouched, and the slide says orphans are down.

Insist on the denominator. Orphans among what. If the denominator is Entra users with a licence, say so in the same sentence as the reduction, or the reduction will be briefed as an estate result. You are on top of the query you wrote.

A second cleanup disables the identity and leaves the credential. The account is disabled. A client secret on a principal that was never a user remains. A password copied into a pipeline remains. Disabling a user is not a rotation, and a rotation is not a permission removal. If the winning description is unchanged, the orphan project changed a record in one stack. It did not change can.

A third cleanup correlates the orphan to a team alias so the who-cell looks full, then certifies it. A cleanup that manufactures owners is a guess with a project code. Weak owners are not a victory condition. If the only route is a channel nobody reads, the cell stays weak, and the campaign that follows will ask that channel to approve the verb. The approval will happen, because channels do not argue. They click, or they miss the mail and the access is retained by default. Retain-on-no-answer is how stale access gets a fresh certification date.

Cleartext and a wide role are not the same kind of untidy

Over-privilege hides on the reviewer's screen as a reasonable name. The reviewer cannot see the configuration if the configuration is a manifest and the campaign shows a role called contributor because that was the entitlement closest to hand. Contributor is a comment unless you have listed the verbs. Some of those verbs are the application. Some are leftovers from a troubleshooting afternoon. The leftovers are stale. The campaign cannot distinguish them while they share a name. Split the rows when the verbs might have different owners. A flag that says the application is over-privileged, with no verb under it, is hygiene.

Cleartext is a blind spot in configuration, not in the directory. No campaign has an entitlement called "password in a file". The morning test still applies to the account that password opens. Reviewers can certify the vaulted copy and never be shown the copy that runs. The credential's existence is not the harm. The verb it unlocks is. Ranking every cleartext find as the first close is a secrets programme, and the wrong first close if none of those secrets unlock a wide verb.

Harm against hygiene, from the objects you already have

Hygiene reaches for the guest who can read one site and has an empty who-cell, because that is what the orphan query returns, and because a guest review is already on the calendar. Harm reaches for the service principal, or the vaulted admin, that can grant roles, reset authentication methods, or deploy to production, because of what the verb changes and how far it reaches. Any access is a surface, in a thin sense. The thin sense is how everything becomes urgent and the short list dies. The guest can sit on a later list. It does not sit on this one while the wide verb is open.

Ask the harm questions of the Billing-Readers row and the name loses. A reset on the billing user store changes who can sign in there as someone else. Reach is that application, not the tenant. Notice is unknown. The who-cell is weak, so use is less likely to be challenged, which is not the same as the verb being wider. Hygiene would rename the group. The short list keeps the row because of the reset.

The order can flip, and the flip is the method working. A wide directory role that is not active, and that a second person has refused to approve all year, is not can this morning. A standing read on a store of payment data, with nobody to call, can outrank it. A method that always prefers the directory role, regardless of state and resource, is familiarity. A method that always prefers the empty who-cell, regardless of verb, is sorting orphans, not harm. You need both. You do not need them to produce the same top row every time. Write the flip down when it happens, so a later meeting does not "correct" the order back to the role name everyone recognises.

Stay in the neighbourhood. Take the rows whose verbs are in the plain wide set: grant, reset, change policy, deploy to production, pull secrets, pay, read at a scope you would not put on a poster, administer the tenant or the equivalent on that resource. You are not scoring the long tail. Leaving the tail unscored is a feature. A method that scores every row will spend the month on the tail, because the tail is most of the rows, and will call that thoroughness.

For each wide row, write what it changes, how far it reaches, whether you would know in time, and whether a second object survives the obvious removal. Add the state and whether the who-cell is empty. A real limit does not reduce harm. It changes what a close can look like. A principal outside the workload limit is not less harmful for being excluded. That feature simply cannot close it. The close, if you choose it, will be the role assignment or the resource policy. Write the close shape in a note if it is obvious. Do not open the ticket.

Then stop and sort by hand. A short list, of verbs you would be willing to defend as the ones that can hurt in this neighbourhood. Not a ranked thousand. If two people disagree on the order, they should disagree in sentences about reach and notice, not in competing integers. Record the disagreement. The owner of the fourth statement decides the order for the brief, using the written rule that harm beats hygiene, not using seniority. If a senior person wants a stale-guest cleanup first because it is visible, the owner says visible to whom. The list stays short.

Do not convert the short list into a register with inherent and residual columns. Residual will be filled with the tooling you hope to buy. You will be back in a grid by another name. The sentences are the register. Prefer the sheet.

Compare the short list to whatever the last hygiene sprint actually did. Show one wide verb the sprint did not touch. If the sprint happened to hit the wide verb, say so. Harm-first is a rule for the next choice, not a prosecution of the last one. The short list is easier to defend when it is not also a weapon.

Reach is a resource fact, not a network zone. A service principal does not become safer because its registration was created somewhere labelled non-production. Answer with the resources the permission can touch, from the assignment and from the resource list. If the short list is all cloud roles, and you know sync drift is in the neighbourhood, either add the synced wide verb or record that you checked and none of the synced groups grant one. An empty check is allowed. A missing check means the diagram won.

Agents extend reach by reuse. A permission set copied onto an agent that can be pointed at new resources reaches further than the sponsor described. The sponsor's description is a comment. The permission set is the reach. Until the exit exists, you cannot claim the reach is temporary. Do not put "agent" on the short list as a technology. Put the verb the agent holds. A special pile for AI is how harm-first becomes a fashion. The fashion will fund a tool. The verb will stay standing. The category is the verb. The agent is the identity. The empty cell is why the state is standing.

The same permission is not the same harm in delegated and application form. What changes is who must be present, and whether multi-factor and user Conditional Access are even in the path. A delegated permission used by a careful admin inside a window can rank below an application permission of the same name that is standing. Get-MgServicePrincipalAppRoleAssignment gives you the application side. The split is a ranking input.

What you still postpone, on purpose

A harm-first list that secretly contains a dozen hygiene items has been captured by guilt. Write the postponed work down so it is a decision. Guests with no wide verb. Licence harvest. Description fields. Enrolment of users who are already inside the covered population, once the uncovered wide accounts are on the list. Directory orphan queries that do not include ser vice principals. Those postponements are the proof the chapter happened. A short list with no postponements is a list that has not chosen.

Capacity is the honest constraint. One neighbourhood, one owner, a deputy, the monthly brief. The short list is already longer than one close. You are producing candidates, not promises. A candidate that seems to need a federation programme may still be the highest harm, and the close might be a local account the application owner can remove this month while federation waits. Drop it because the target architecture is far away, and you have ranked by project size. Prefer the ugly admin.

"All privileged users" is not a harm analysis. Eligibility for a hundred people, with self-approval, is standing access with a queue. Use the verbs. An exercise is useful when it tests notice, and a bad way to discover the grant, because exercises follow paths defenders already find interesting. Do not wait for one to authorise the list. If the objective you are handed counts "high risks" closed, it will be met by recategorising guests. The objective, if you need one, is the short list in sentences, one close, and a proof that it stayed closed.