Access Rights Audit: Who Can See Company Data

The short answer: An access rights audit determines which company data each person can actually access, through which account, group, role or sharing link, and whether they have a legitimate business need to do so. The result should be an overview of effective permissions, a specific list of risks and a remediation plan that can be verified after changes are made.

A list of accounts is not enough

A company may maintain an accurate employee list and still have no clear idea who can see payroll records, contracts or customer folders. Access is not granted solely by assigning permissions directly to an individual.

A user may gain access to data through:

• membership in one or more groups;
• a nested group in Active Directory or Microsoft Entra ID;
• permissions inherited from a parent folder;
• a direct exception on a specific file or directory;
• a system administrator role;
• an external guest account;
• a link intended for specific people or anyone who obtains it;
• a shared account or password;
• a service account used by an application or automation.

An audit therefore examines not only configured permissions but, above all, effective access: what a user can actually open, modify, download, share or administer.

Start by identifying data, roles and owners

The review should not begin by exporting every user account. First, the company needs to identify which data it is protecting, who decides whether access should be granted and which job roles need it.

Typical owners may include the managing director, finance director, sales manager or HR manager. An IT administrator may configure permissions, but should not independently decide whether a salesperson needs access to payroll records or whether an external accountant needs access to all company documentation.

A role-and-system matrix provides the basic reference point:

Role	System or data	Required access	Assignment method	Owner
Accountant	Accounting folder on the NAS	read and write	UCETNI group	company management
Sales representative	CRM	standard user	application role	sales manager
HR manager	HR documents	read and write	PERSONALNI group	company management
External IT provider	Server administration	administrative access for the necessary period	separate account	managing director

The matrix describes the target state. Only by comparing actual permissions against it can the company reasonably determine whether a particular permission is necessary, excessive or missing.

The principle of least privilege does not mean denying everyone access to everything. Users should receive the access they need for their work, limited to the necessary scope and duration. Restrictions imposed without an understanding of day-to-day operations often lead people to copy documents outside managed storage or share passwords.

What a company access audit should cover

The scope depends on the systems in use, not merely on the number of employees. A small company with a NAS, Microsoft 365, a VPN, accounting software and several contractors may have more complex permissions than a larger company with centrally managed identities.

At a minimum, the review will usually need to cover:

1. user, administrator, guest and service accounts;
2. groups, nested memberships and application roles;
3. shared folders on NAS devices and Windows Server;
4. SharePoint, OneDrive, Teams and shared mailboxes;
5. VPN access, remote administration and supplier access;
6. public and external sharing links;
7. shared passwords, multi-factor authentication and emergency accounts;
8. former employees’ accounts and access without an identified owner;
9. API keys, integration accounts and automations tied to a particular person.

The scope of each permission also matters. It is not enough to note that a user „has access." The audit must distinguish between reading, writing, deleting, sharing, changing permissions and full administration.

Windows Server: combine share and NTFS permissions

Folders made available over SMB usually have two layers of permissions: share permissions and NTFS file-system permissions. Network access is restricted by both layers.

A common configuration may leave share permissions broad while using NTFS groups to impose the actual restrictions. An Everyone entry on the share therefore does not by itself prove that everyone can read its contents. The auditor must evaluate the entire access path down to the individual user.

The review should determine:

• which shared folders exist and who is responsible for them;
• which groups can read, modify or fully manage their contents;
• whether permissions are inherited by subfolders;
• where inheritance has been disabled;
• whether direct exceptions exist for individual users;
• how membership in multiple groups affects access;
• whether calculated access matches practical testing.

A command or export showing the ACL is only one part of the evidence. A list of entries alone may not accurately explain group membership, nested groups and the resulting permissions of a specific identity.

Synology and QNAP: check local and domain groups

On Synology devices running DSM and QNAP devices running QTS, users may gain access through a local NAS account, a local group, an Active Directory account or ACLs inherited from a parent folder. In addition to standard shared folders, the audit should cover home directories, application permissions, administrator groups and any connections to cloud services.

A NAS audit should answer the same questions as a Windows Server review:

• who can open a shared folder;
• who can modify or delete data within it;
• who can change its permissions;
• whether individual exceptions exist;
• whether the account or group still corresponds to an actual job role.

Assigning rights to groups is generally easier to manage than maintaining dozens of individual exceptions. When a new accountant joins, their membership in the UCETNI group can be updated without searching for their name in every folder separately.

Microsoft 365: review roles, guests and links

In Microsoft 365, access can be granted through a Microsoft 365 group, security group, team, SharePoint site, direct permission, external guest or sharing link. These access paths need to be assessed together.

A document may be correctly restricted to team members while an older „anyone with the link" link still exists. Such a link can be forwarded to another person and, depending on its settings, may not require authentication. A link for specific people is more precise, but it should not remain active without an owner and a valid reason either.

The review should include:

• external guests and their last known purpose;
• anonymous links and links without an expiry date;
• direct permissions outside standard team membership;
• owners of teams and SharePoint sites;
• permissions for individual folders and documents;
• shared mailboxes and Full Access, Send As and Send on behalf rights;
• administrator roles in Microsoft Entra ID;
• everyday work accounts that also hold the highest administrator role.

An administrator’s everyday account should not be a global administrator merely for convenience. A separate account should be used for administration, and the number of top-level administrators should reflect genuine operational and backup needs. If a suspicious sign-in or change to mail rules has already occurred, follow the guide for a compromised Microsoft 365 account.

When an employee leaves: block access, but do not delete blindly

When an employee leaves, the company needs to block sign-in promptly and terminate active sessions. Irreversibly deleting the identity is a separate matter. Before doing so, the company must transfer necessary data, email, documents, team ownership and dependent automations.

The audit should look particularly for:

• active accounts belonging to former employees;
• contractors whose access has no defined end date;
• unused local accounts on servers and NAS devices;
• access registered to private email addresses;
• VPN profiles and remote administration accounts;
• API keys and service accounts tied to a particular person;
• shared passwords that a former employee still knows.

Hasty deletion can interrupt backups, synchronisation, accounting integrations or automated exports. If the company is taking over infrastructure from an administrator or supplier, the checklist Our IT administrator left and nobody knows the passwords can help.

Shared accounts conceal who made a change

Accounts such as warehouse, reception or admin, whose passwords are known by several people, make it impossible to reliably attribute a specific action to a specific person. When an employee leaves, their access also cannot be revoked without changing the password for everyone else.

Each person should have their own account. Technical credentials that cannot be eliminated entirely belong in a company password manager with controlled sharing, a change history and the ability to remove individual users. We discuss how to choose a solution in Password managers for businesses.

Important accounts should use multi-factor authentication. Where supported, passkeys or FIDO2-based hardware keys provide better protection against fraudulent sign-in pages than manually entered codes. The company must also address backup sign-in methods, lost devices and emergency access. The practical differences are explained in MFA in business: passkeys and FIDO2 instead of SMS.

What a useful audit report should look like

The result of an audit should not be a collection of technical exports without explanation. A company needs at least three connected outputs.

Role-and-system matrix

This describes the approved target state: which role needs which access, who approved it and who is responsible for the relevant data.

List of findings

Each finding should identify a specific account, group, folder, role or link. It should include evidence, the business impact and a proposed next step.

Instead of a vague statement such as „permissions are incorrect," the report should say, for example:

Through inherited NTFS permissions, the OBCHOD group can modify the Mzdy folder. The owner of the HR data has not confirmed that this access is required. Before removing it, the company will verify whether the same group is used for a necessary export to the accounting system.

Remediation and verification plan

The plan identifies the responsible person, sequence of changes, deadline, rollback procedure and method of follow-up verification. A change cannot be considered complete merely because an administrator saved it. The company must verify that the unauthorised user has lost access while authorised users can continue working.

If nobody in the company can reliably determine who can see sensitive data, we can carry out this process as part of an IT audit. The article IT audit for a small business explains the process step by step. The result is a documented current state, remediation priorities and evidence for repeat reviews—not merely an uncommented account export.

Keep remediation separate from evidence gathering

The audit itself can be conducted largely by reading configurations and exports and verifying selected scenarios. It should not automatically change passwords, disable accounts or rewrite permission inheritance.

Bulk changes to NTFS permissions, removal of every external link or deactivation of service accounts can disrupt normal operations. Before any significant change, the company should:

1. confirm the finding with the data owner;
2. identify dependencies on the account or group;
3. record the original configuration;
4. prepare a rollback procedure;
5. make a limited change;
6. verify both intended and unintended access;
7. only then continue with other accounts or folders.

Priority should be given to abandoned administrator accounts, publicly accessible sensitive documents, unmanaged remote access and shared passwords for important systems. The exact order, however, must reflect the potential impact on the particular company.

How often access rights should be reviewed

A one-off audit can clean up historical issues, but it will not prevent new exceptions from emerging. Reviews should be linked to events that affect permissions:

• an employee joining or leaving;
• a change of job role;
• a contractor starting or finishing work;
• the introduction of a new system or storage platform;
• the reorganisation of shared folders;
• a security incident;
• the transfer of IT management from another administrator.

A quarterly review may be a reasonable starting interval for a smaller company, but it is not a universal requirement. More sensitive environments or frequent staffing changes may require shorter cycles, while a stable system with well-managed roles may use a different interval based on its own risk profile.

NIS2 and GDPR: an audit is not a compliance certificate

Access control is among the security measures addressed by personal data protection and cybersecurity requirements. An audit can document the actual state, permission owners and completed remediation. On its own, however, it does not demonstrate full compliance with GDPR, the NIS2 Directive or the Czech zákon č. 264/2025 Sb., o kybernetické bezpečnosti.

The article NIS2 and zákon 264/2025 Sb. summarises who falls within the scope of the new law. Compliance also depends on risk management, backups, incident response, supplier management, business continuity and other measures. The claim „we have audited access, so we are compliant" is therefore not a defensible conclusion.

Frequently asked questions

How long does an access rights audit take?

It depends on the number of systems, groups and individual exceptions, as well as the quality of the documentation. A company with twenty people may have more complex permissions than one with fifty employees if it uses several separate cloud services, a local NAS and legacy contractor accounts.

Do passwords have to be changed during an audit?

Not automatically. A change is appropriate, for example, when a password is shared, compromised or otherwise untrustworthy. Evidence gathering should remain separate from remediation so that the audit itself does not cause an outage.

Is an „anyone with the link" link always a mistake?

Not always. It must, however, have a specific purpose, an owner, an appropriate scope and a defined validity period. Sharing with named and verified individuals is generally more appropriate for internal, HR or contractual documents.

Is removing a former employee from groups enough?

No. The company also needs to review cloud, local, VPN and administrator accounts, active sessions, shared passwords, data ownership, integration keys and automations tied to that person’s identity.

How can you tell that an audit was more than a formality?

For every significant access path, it must be possible to determine how it arose, who approved it and whether it reflects a genuine business need. After remediation, the company must verify that excessive access has been removed without depriving authorised users of the data they need.

Where to find us

ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.

Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).