How to Get Real-Time Microsoft 365 Risk Assessments (Case Study)
Case Study – Refinery
The Challenge
The movement to Microsoft 365 has been a game changer for organizations and their MSPs, but a flurry of user collaboration can bring chaos to data creation and oversight.
“Leadership teams feel as though they have lost control,” said Ian Bennett, chief operating officer of Business Refinery. “Many of them have come to me saying, ‘Hey, I’ve just realized my employees are creating a bunch of Teams and I don’t know about them.’ They want to know when a document was shared or when someone creates or joins a Team.
“A lot of business owners want to be included in every Team, which breaks the trust model.”
Pulling permissions reports manually in Microsoft 365 to get this information is a time-intensive and complex practice, and it can be a tall order for companies without the IT staff or know-how. Furthermore, constant new activity makes even a thorough analysis outdated within minutes.
So, when Business Refinery tried to handle those tasks after clients requested it, the task quickly became unsustainable. “We started building out reports and email summaries of changes to the tenant, but the requirements and requests just kept growing,” Bennett said. “At that point, I thought, ‘I better look for a solution that does the job for me.’”
The AvePoint Solution
At the suggestion of their partner, Ingram Micro, leaders at Business Refinery identified AvePoint’s Policies & Insights (or “PI”) to deliver critical, automated intelligence to customers.
PI is designed to analyze risk and access sensitive documents by proactively monitoring and remediating policy violations in Microsoft 365. It also provides actionable security dashboards to highlight and track exposure (anonymous links, external user access) over time.
Receiving near-real-time updates via PI that prioritize the most widely shared sensitive data allows users to set ownership and sharing restrictions that support safe, collaboration.
“When we started looking at what was already on the market, PI was the perfect fit,” Bennett said.
By offering PI as a 30-day free trial for existing clients, Business Refinery immediately uncovered widespread — and serious — concerns in Microsoft Teams that proved the solution’s value.
“One client had more than 30,000 anonymous shared links across their company — and they only had about 40 users,” Bennett said, adding that the findings helped them implement tenant-wide policies and robust user training across the entire organization.
“We’ve had others realize that they have duplicate Teams with different people granted access for each one, so they’re able to do a bit of a cleanup.”
By using PI to assess risks, Business Refinery has seen an 80% time savings that is critical to its bottom line and bandwidth. “The reduction in manual data capture enables us to spend more quality time with the customer,” Bennett said.
Business Refinery now offers PI as a recurring monthly subscription to 8 clients, and the solution is featured in every sales pitch.
“It has become part of our onboarding for new customers by telling them there is risk, and that Policies & Insights gives them the exposure to observe it for themselves without being included in every single transaction,” Bennett said.
For MSPs helping multiple customers, the AvePoint Elements portal offers a simple way to keep tabs and field questions in one place.
“What’s great for MSPs is that you can equip leadership teams with the tools to observe and remedy the risks without needing to grant them admin access in Microsoft 365, which reduces risk — especially from user error,” Bennett said.
The Bottom Line
When it comes to total collaboration security, PI plays a key role at Business Refinery. But it’s just one piece of the pie.
“It opens the door to start conversations around a customer’s risk and exposure, which then gives you a better understanding of their business and what tech stack they need to thrive,” said Bennett, noting that he incorporates customers’ PI data in their quarterly business reviews.
Although PI findings might be sobering for customers, they can also bring peace of mind.
“Being able to drill into those specifics is key,” Bennett said. “It’s been incredible using Policies & Insights to open business owners up to the realization that there are real risks, but with careful management and observation, they shouldn’t be having sleepless nights over it.”
Refinery
Refinery is a strategic partner to managed service providers and some direct clients. The company’s mission is to drive productivity and utilization of technology across small to midsize businesses, while maintaining security and reducing risks. The team is passionate about delivering personalized digital transformation guidance.
Read the full case study here.
Kayla Haskins is a Content Marketing Manager at AvePoint, writing about all things cloud collaboration – including Power Platform, Microsoft 365, Google Workspace, and Salesforce. An advocate of operational governance and process automation, Kayla creates content that helps businesses manage technology to drive efficiencies in the modern workplace and make work/life balance a reality.
View all posts by Kayla Haskins
Share this blog
