Entra directory cleanup as a recurring MSP service

Stale titles, groups, owners

Every small tenant drifts. A person is promoted and their job title never changes. Someone leaves and remains the only owner of a Team. A security group built for one project still grants access two years later. None of this breaks anything on the day it happens, which is why nobody fixes it.

Drift matters because the directory is what everyone else trusts. Access reviews, dynamic groups, and org charts all read it. A wrong title or a departed owner quietly makes those tools wrong too.

The common findings fall into three buckets: titles that disagree with observed activity, groups and Teams with one owner or none, and sites and enterprise apps whose only owner is a single person. Two limits to know: distribution lists created in Exchange do not have owners that can be read, and shared mailboxes show who sends from them, not who owns them.

A quarterly deliverable

Hygiene sold once is a project. Hygiene sold every quarter is a service, and directories drift fast enough to justify it. The deliverable each quarter is the same shape: what changed, what drifted, what you fixed, and what needs a decision from the owner.

Run the report at the start of the quarter, fix what you can without the client (second owners, retired groups the client has approved), and bring the rest to the quarterly review. The next run shows whether the fixes held.

Pricing it

Price the service on your own terms, as a fixed quarterly fee per tenant, so the client is buying the outcome rather than your hours. Your input cost is predictable: a single firm report is $199, and the MSP 10-pack is $1,290 for ten client tenants.

The fixes themselves are mostly minutes of admin work each. That is the margin. Resist the urge to bill them hourly; the client values a clean directory, not a timesheet.

The before/after table

The artifact that sells the renewal is a before/after table. Here is a synthetic example for a fictional twelve-person firm, with one row per finding.

• Finance SharePoint site. Before: one owner. After: two owners.
• Vendor-payments shared mailbox. Before: one sender in 90 days, owner unknown. After: two senders; owner recorded by the client.
• Project Alder security group. Before: 14 members, project closed. After: retired with client approval.
• Job title for the operations lead. Before: Receptionist. After: Operations Lead.
• Payroll portal enterprise app. Before: one owner. After: two owners.