Internal Management / Sensitive
Detailed Microsoft 365 Email & Group Access Audit
CEO-facing access matrix based on the PowerShell checks performed during the Tenbex Microsoft 365 audit. It identifies who can open Shared Mailboxes, who is a member of Microsoft 365 Groups, who is subscribed to group conversations/notifications, forwarding paths, external identities, legacy identities, ownerless groups and governance risks.
Executive Summary
4
Shared Mailboxes explicitly audited
5
User/functional mailboxes explicitly audited
40+
M365 groups / collaboration objects reviewed
12
Ownerless M365 groups confirmed
Critical governance theme: departmental Shared Mailboxes are generally implemented correctly, but the wider environment shows weak lifecycle governance: ownerless groups, parallel functional groups, external-only collaboration, personal Gmail access, legacy identities still holding access, and old project workspaces retained without clear ownership.
Interpretation: “Member” is from Get-UnifiedGroupLinks -LinkType Members. “Subscriber” is from -LinkType Subscribers and indicates subscription to group conversations/calendar notifications; it is not the only possible delivery/access path.
User Mailboxes / Functional Addresses
| Mailbox | Observed access / forwarding | Risk | Assessment |
|---|---|---|---|
| Enquiry [email protected] | Forwards to [email protected]; DeliverToMailboxAndForward=True. Enquiry Team observed member: Faiz — [email protected]. | MEDIUM | Functional address is a UserMailbox rather than Shared Mailbox; direct-login/lifecycle model should be reviewed. |
| Fleet Manager [email protected] | No explicit FullAccess delegates or forwarding detected. | LOW | Low relevance to shared-access risk. |
| Admin Primavera [email protected] | No explicit FullAccess delegates or forwarding detected. | LOW | Review business purpose only. |
| Backup File [email protected] | No explicit FullAccess delegates or forwarding detected. | LOW | Review business purpose only. |
| TESB UTP [email protected] | No explicit FullAccess delegates; no mailbox forwarding; no inbox forwarding/redirect rule detected. | MEDIUM | Functional UserMailbox. Document why a direct-login user identity is required, or consider Shared Mailbox if it is truly a role address. |
Audit Limitation, Fairness & Governance Context
This audit is a technical access review based on Microsoft 365 / Exchange Online evidence. It is designed to identify where management validation is required, not to make assumptions about an employee's job scope, seniority, authority or business need.
Important limitation of this audit
The audit did not have a complete and authoritative source for every employee's official job title, current department, project appointment, delegated authority, management responsibility or business justification. Therefore, the presence of a user in multiple Microsoft 365 Groups, Shared Mailboxes or sensitive functional groups does not automatically mean the access is incorrect or unauthorized.
A user may legitimately require broader access because of management duties, cross-functional responsibilities, project assignments, temporary operational requirements, committee appointments or specific instructions from authorized management.
Management validation is required before any access is removed
Findings such as access to TOP MANAGEMENT, Finance, HR, IT, QA, HSE, Procurement, Sales or other cross-functional groups should be treated as management review points, not as automatic violations. The final decision on whether an individual should retain or lose access should be made by the relevant Business Owner, Department Head, CEO or Top Management based on the person's actual responsibility and authority.
Principle of Authority / Punca Kuasa
For good governance, every material access decision should have a clear and traceable source of authority (punca kuasa). This protects both the company and the administrator who implements it.
- Management or Board/Executive meeting decision.
- CEO / Top Management instruction or formally recorded veto/approval.
- Department circular, SOP or policy.
- Approved job description or responsibility matrix.
- Project appointment letter / project organization chart.
- Business Owner or Department Head approval.
- Contractual or client requirement.
- Time-bound emergency or operational authorization, followed by review.
Best-practice decision model
Business Management authorizes access; IT implements and records it.
IT administrators should not become the permanent sole decision-maker for who is entitled to confidential departmental or management information. Their role is to implement approved access, enforce technical controls and maintain an audit trail.
Business Owners and management are responsible for deciding whether access is justified and accepting the corresponding business risk.
Minimum Access Authorization Record
Tenbex should maintain a simple access register so every important permission can be explained during management review, client audit, staff transfer or employee offboarding.
| Required Field | Purpose | Example |
|---|---|---|
| User / Identity | Who is receiving access. | Siti Nur Khadijah — [email protected] |
| Resource | Mailbox, group, Team, SharePoint site or application. | [email protected] |
| Business Reason | Why the access is necessary. | Management coordination / approved project responsibility |
| Approver / Punca Kuasa | Who authorized the access. | CEO / Top Management / Department Head |
| Approval Reference | Evidence that can be traced later. | Management Meeting MM-2026-08 / departmental circular / approved email |
| Effective Date | When access became valid. | 01 Aug 2026 |
| Review / Expiry Date | When access must be recertified or removed. | 31 Dec 2026 / project closeout |
Fairness statement
This report does not assign blame to any individual user or previous administrator. Its purpose is to help Tenbex ensure that every access to company information assets has a legitimate business reason, documented authority, accountable owner, periodic review and appropriate security control.
Where access cannot currently be linked to a documented source of authority, the correct response is management validation and governance improvement — not an immediate assumption of misconduct.
Recommended wording for management decisions
Use: “Membership requires management validation against current role, responsibility and authority.”
Avoid: “This user should not be in this group.”
This distinction keeps the audit factual, fair and defensible while still highlighting security and governance issues that require executive attention.
Individual User Access Concentration & Role Alignment
This section reverses the audit view: instead of asking “who is inside each group?”, it shows how many different company mail/group resources each individual can access. This is important for segregation of duties, need-to-know, privacy and management accountability.
CEO attention: a high number of memberships is not automatically wrong. Senior management,
IT, governance or project personnel may legitimately require broad access. However, memberships in
sensitive or cross-functional groups such as TOP MANAGEMENT, Finance, HR, IT, QA and HSE
should be explicitly validated against the person's current role and management authority.
This report flags them for review; it does not declare the individual unauthorized.
Access terminology: Microsoft 365 Group membership is different from Shared Mailbox
FullAccess. Group membership provides access to the M365 Group and its connected resources
according to configuration. Shared Mailbox FullAccess means the delegate can open/read the mailbox.
“Subscriber” is separately shown because it indicates inbox subscription to group conversations/notifications.
Highest Access Concentration Observed
Siti Nur Khadijah
19M365 Groups
0Shared Mailboxes
0Subscriptions
11Sensitive / cross-functional
Groups: HSE, IT, QA, TOP MANAGEMENT, Proposal, Project Management 1, Special Project / Center of Excellence, EFEMS, HRAQ, Porcument, HR1, Sales157, Finance982, PREFCHEM, PRefChem59, PTTEP802, BackupData, SKA, EPCC
Role-alignment review: HSE, IT, QA, TOP MANAGEMENT, Project Management 1, HRAQ, Porcument, HR1, Sales157, Finance982, BackupData
Anis
19M365 Groups
0Shared Mailboxes
0Subscriptions
8Sensitive / cross-functional
Groups: HSE, IT, QA, Proposal, PROPOSAL337, Project Management 1, Tenbex Engineering Info, Special Project / Center of Excellence, EFEMS, E&I, Porcument, HR1, Sales157, Finance982, PREFCHEM, PTTEP802, SKA, EPCC, Self-Installed & Relocatable Platform (SIReP)
Role-alignment review: HSE, IT, QA, Project Management 1, Porcument, HR1, Sales157, Finance982
Aznan
19M365 Groups
0Shared Mailboxes
0Subscriptions
7Sensitive / cross-functional
Groups: HSE, IT, TOP MANAGEMENT, Proposal, PROPOSAL337, Tenbex Engineering Info, Special Project / Center of Excellence, EFEMS, E&I, Porcument, HR1, Sales157, Finance982, PREFCHEM, PTTEP802, SKA, EPCC, Self-Installed & Relocatable Platform (SIReP), SIReP - TENBEX & NRE
Role-alignment review: HSE, IT, TOP MANAGEMENT, Porcument, HR1, Sales157, Finance982
Shaharil
18M365 Groups
0Shared Mailboxes
0Subscriptions
7Sensitive / cross-functional
Groups: HSE, IT, QA, TOP MANAGEMENT, Proposal, PROPOSAL337, Special Project / Center of Excellence, EFEMS, E&I, Porcument, Sales157, Finance982, PREFCHEM, PTTEP802, SKA, EPCC, Self-Installed & Relocatable Platform (SIReP), SIReP - TENBEX & NRE
Role-alignment review: HSE, IT, QA, TOP MANAGEMENT, Porcument, Sales157, Finance982
Shahiman
16M365 Groups
0Shared Mailboxes
0Subscriptions
6Sensitive / cross-functional
Groups: HSE, TOP MANAGEMENT, Proposal, Special Project / Center of Excellence, EFEMS, E&I, Porcument, Sales157, Finance982, FINANCE - AUDIT 2024, PREFCHEM, PTTEP802, SKA, EPCC, Self-Installed & Relocatable Platform (SIReP), SIReP - TENBEX & NRE
Role-alignment review: HSE, TOP MANAGEMENT, Porcument, Sales157, Finance982, FINANCE - AUDIT 2024
Faiz Amran
12M365 Groups
0Shared Mailboxes
2Subscriptions
3Sensitive / cross-functional
Groups: HSE, HSE DEPARTMENT, Proposal, PROPOSAL337, Tenbex Engineering Info, E&I, PTTEP MAINTENANCE CONTRACT, SIREP Sharing Folder, TENBEX HSE QUESTIONNAIRE, EPCC, Self-Installed & Relocatable Platform (SIReP), UTP013/2026(T3)
Role-alignment review: HSE, HSE DEPARTMENT, TENBEX HSE QUESTIONNAIRE
Shahiffudin
9M365 Groups
0Shared Mailboxes
0Subscriptions
0Sensitive / cross-functional
Groups: Proposal, Special Project / Center of Excellence, EFEMS, E&I, PREFCHEM, PTTEP802, SKA, EPCC, Self-Installed & Relocatable Platform (SIReP)
Role-alignment review: None identified
Khairul Anam
7M365 Groups
0Shared Mailboxes
0Subscriptions
2Sensitive / cross-functional
Groups: PROPOSAL337, Tenbex Engineering Info, E&I, Sales1, Sales157, EPCC, UTP013/2026(T3)
Role-alignment review: Sales1, Sales157
Azrina
6M365 Groups
0Shared Mailboxes
0Subscriptions
3Sensitive / cross-functional
Groups: Tenbex Engineering Info, Tenbex Engineering 124, Porcument, Sales1, Sales157, Self-Installed & Relocatable Platform (SIReP)
Role-alignment review: Porcument, Sales1, Sales157
Raha Izlan
6M365 Groups
0Shared Mailboxes
0Subscriptions
1Sensitive / cross-functional
Groups: QA, PROPOSAL337, PCOGD TA26 Rotating, SIReP FEED Documents, EPCC, Self-Installed & Relocatable Platform (SIReP)
Role-alignment review: QA
Farid Anas
5M365 Groups
0Shared Mailboxes
1Subscriptions
2Sensitive / cross-functional
Groups: HSE, HSE DEPARTMENT, PCOGD TA26 Rotating, Self-Installed & Relocatable Platform (SIReP), UTP013/2026(T3)
Role-alignment review: HSE, HSE DEPARTMENT
Muhammad Isyraf Bin Anuar
5M365 Groups
0Shared Mailboxes
1Subscriptions
1Sensitive / cross-functional
Groups: PROPOSAL337, PTTEP802, PTTEP MAINTENANCE CONTRACT, PTTEP MEETING, SEAH LCOT Split-Unit MEC/SVS/201837 Meeting
Role-alignment review: SEAH LCOT Split-Unit MEC/SVS/201837 Meeting
Complete Individual Access Register
Tip: on desktop, drag the horizontal scrollbar to view all columns. Click any column header to sort A–Z / Z–A or low–high / high–low.
| User / Identity | Total Access Points | M365 Group Memberships | Shared Mailbox FullAccess | Group Subscriptions | Sensitive / Cross-functional Groups | CEO Review |
|---|---|---|---|---|---|---|
|
Siti Nur Khadijah [email protected] |
19 | 19
|
0None | 0None | 11
|
HIGH REVIEW |
|
Anis [email protected] |
19 | 19
|
0None | 0None | 8
|
HIGH REVIEW |
|
Aznan [email protected] |
19 | 19
|
0None | 0None | 7
|
HIGH REVIEW |
|
Shaharil [email protected] |
18 | 18
|
0None | 0None | 7
|
HIGH REVIEW |
|
Shahiman [email protected] |
16 | 16
|
0None | 0None | 6
|
HIGH REVIEW |
|
Faiz Amran [email protected] |
12 | 12
|
0None | 2
|
3
|
HIGH REVIEW |
|
Shahiffudin [email protected] |
9 | 9
|
0None | 0None | 0None | REVIEW |
|
Khairul Anam [email protected] |
7 | 7
|
0None | 0None | 2
|
REVIEW |
|
Azrina [email protected] |
6 | 6
|
0None | 0None | 3
|
REVIEW |
|
Raha Izlan [email protected] |
6 | 6
|
0None | 0None | 1 | REVIEW |
|
Farid Anas [email protected] |
5 | 5
|
0None | 1
|
2
|
REVIEW |
|
Muhammad Isyraf Bin Anuar [email protected] |
5 | 5
|
0None | 1
|
1
|
REVIEW |
|
Hisyam [email protected] |
4 | 4
|
0None | 0None | 3
|
REVIEW |
|
Muhammad Syahmi [email protected] |
4 | 4
|
0None | 0None | 0None | NORMAL |
|
Nur Amira [email protected] |
3 | 3
|
0None | 0None | 3
|
REVIEW |
|
Norhidayah [email protected] |
3 | 3
|
0None | 0None | 3
|
REVIEW |
|
Atikah [email protected] |
3 | 3
|
0None | 0None | 3
|
REVIEW |
|
Amirun [email protected] |
3 | 3
|
0None | 0None | 2
|
REVIEW |
|
Adriana [email protected] |
3 | 3
|
0None | 0None | 1 | NORMAL |
|
Shahiffudin Khamis [email protected] (UPN; no Primary SMTP) |
3 | 3
|
0None | 0None | 1
|
NORMAL |
|
Mohd Asyraf Bin Mohd Sakeri No Primary SMTP shown |
3 | 3
|
0None | 3
|
0None | NORMAL |
|
Mohd Aiman bin Md Tasyrif [email protected] (UPN; no Primary SMTP) |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Amirulamin [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Hadi Anuar [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
M Ashfan [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Awang Mohamad Syaddad No Primary SMTP shown |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Mohamad Johari bin Dasri [email protected] (UPN; no Primary SMTP) |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Burhani [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Hasniza [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Wan Rohaimi [email protected] |
3 | 3
|
0None | 0None | 0None | NORMAL |
|
Admin shared mailbox [email protected] |
2 | 2
|
0None | 0None | 2
|
REVIEW |
|
Syaifuddin [email protected] |
2 | 2
|
0None | 0None | 2
|
REVIEW |
|
Nur Atirah Binti Asmi No Primary SMTP shown |
2 | 2 | 0None | 2 | 1 | NORMAL |
|
Mukhriz [email protected] |
2 | 2
|
0None | 1
|
1
|
NORMAL |
|
Natasyah [email protected] |
2 | 2 | 0None | 0None | 1 | NORMAL |
|
Ubaidah [email protected] |
2 | 2 | 0None | 0None | 1 | NORMAL |
|
MUHAMMAD No Primary SMTP shown |
2 | 2
|
0None | 2
|
0None | NORMAL |
|
Anas Amsyar [email protected] |
2 | 2
|
0None | 1
|
0None | NORMAL |
|
Maryam [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Wafi [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Fila Aliya [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Amin [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Mohd Fauzan Ashraf bin Turedy No Primary SMTP shown |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Aliff Najmi [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Zuhairi [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Asymerul [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Mustaffa [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Arman [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Ariff Hakimy [email protected] |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
Mohamad Afif Mohd Shahimee [email protected] (UPN; no Primary SMTP) |
2 | 2
|
0None | 0None | 0None | NORMAL |
|
M Fauzia [email protected] |
1 | 1
|
0None | 0None | 1
|
NORMAL |
|
FARID ASYRAAF LU ABDULLAH No Primary SMTP shown |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
Habib [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
NURFARHIN.MATORI [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
SHUKORSEMAN [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
Sofian Hamila [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
[email protected] [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
hafizuddinms [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
haslinda [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
Dato' Johari Dasri [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
Dato' Seri Sri Udani [email protected] |
1 | 1
|
0None | 1
|
0None | NORMAL |
|
Safri [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Ku Firdaus [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Ahmad Shahran [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
M Firdaus Sher [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Linda [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
MKZA [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Fariza [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Sarah [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Shafiza [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Shahirah [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Che Amirul Ashraf [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Asyraf Mazlan [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Nur Iman [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Sean [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Ku Khairi [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Muhammad Amirul Haikal [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Anita Mokhtar [email protected] (UPN; no Primary SMTP) |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
TESB UTP [email protected] |
1 | 1
|
0None | 0None | 0None | NORMAL |
|
Mohamad Johari bin Dasri [email protected] |
0 | 0None | 0None | 3
|
0None | NORMAL |
|
Shahiffudin Khamis [email protected] |
0 | 0None | 0None | 3
|
0None | NORMAL |
|
Mohamad Afif Mohd Shahimee [email protected] |
0 | 0None | 0None | 2
|
0None | NORMAL |
|
Anita Mokhtar [email protected] |
0 | 0None | 0None | 1
|
0None | NORMAL |
Specific example requiring management validation
Siti Nur Khadijah — [email protected] was observed as a member of 19 Microsoft 365 Groups. These included HSE, IT, QA, TOP MANAGEMENT, Proposal, Project Management 1, Center of Excellence, EFEMS, HRAQ, Porcument, HR1, Sales157, Finance982, PREFCHEM, PRefChem59, PTTEP802, BackupData, SKA and EPCC.
The audit cannot determine from Exchange data alone whether each membership is appropriate to her HR/job role. The CEO/business owners should specifically validate sensitive memberships such as TOP MANAGEMENT, Finance-related, HR-related, IT, QA and other cross-functional groups against current responsibility and authority.
Microsoft 365 Groups — Detailed Access Matrix
Tip: on desktop, drag the horizontal scrollbar to view all columns. Click any column header to sort A–Z / Z–A or low–high / high–low.
| Group / Email | Members / Access | Subscribers | Risk | Audit Note |
|---|---|---|---|---|
| HSE [email protected] | 7
| 0None detected | MEDIUM | 7-member functional group. |
| HSE DEPARTMENT [email protected] | 2
| 1
| MEDIUM | Parallel HSE group; validate distinct purpose. |
| IT [email protected] | 4
| 0None detected | MEDIUM | 4 members. |
| QA [email protected] | 4
| 0None detected | MEDIUM | 4 members. |
| Finance [email protected] | 4
| 0None detected | MEDIUM | Includes admin@ shared mailbox; admin delegates are not automatically Finance members. |
| TOP MANAGEMENT [email protected] | 4
| 0None detected | MEDIUM | 4 members. |
| Proposal [email protected] | 10
| 0None detected | MEDIUM | 10 members; includes enabled non-mailbox Mohd Aiman object. |
| PROPOSAL337 [email protected] | 13
| 0None detected | MEDIUM | 13 members; overlaps Proposal@. |
| Project Management 1 [email protected] | 3
| 0None detected | MEDIUM | 3 members. |
| Tenbex Engineering Info [email protected] | 20
| 3
| HIGH | 20 members, 3 subscribers; multiple no-SMTP identities. |
| Tenbex Engineering 124 [email protected] | 3
| 0None detected | MEDIUM | All three also in tenbexengineering@; strong duplicate/legacy candidate. |
| Special Project / Center of Excellence [email protected] | 8
| 1
| MEDIUM | 8 members, 1 subscriber. |
| EFEMS [email protected] | 14
| 0None detected | MEDIUM | 14 members. |
| E&I [email protected] | 11
| 1
| MEDIUM | 11 members, 1 subscriber. |
| HRAQ [email protected] | 1
| 0None detected | LOW | Single-member group. |
| Porcument [email protected] | 7
| 0None detected | HIGH | Misspelled procurement-related group; parallel structure. |
| HR1 [email protected] | 10
| 1
| HIGH | 10 members, 1 subscriber; parallel HR structure. |
| Sales1 [email protected] | 3
| 0None detected | HIGH | Parallel Sales group. |
| Sales157 [email protected] | 8
| 0None detected | HIGH | Third Sales-related object; canonical purpose unclear. |
| Finance982 [email protected] | 8
| 0None detected | HIGH | Parallel Finance group; overlaps Finance@. |
| FINANCE - AUDIT 2024 [email protected] | 4
| 0None detected | MEDIUM | Project/legacy Finance group. |
| PREFCHEM [email protected] | 14
| 2
| HIGH | 14 members, 2 subscribers. |
| PRefChem59 [email protected] | 12
| 2
| HIGH | 12 members, 2 subscribers; substantial overlap with PREFCHEM@. |
| PTTEP802 [email protected] | 13
| 2
| HIGH | 13 members, 2 subscribers. |
| PTTEP [email protected] | 2
| 2
| HIGH | 0 owners; both are non-mailbox User objects. |
| BackupData [email protected] | 4
| 0None detected | MEDIUM | 4 members. |
| ExInspection [email protected] | 3
| 0None detected | LOW | 3 members. |
| MSA Ex [email protected] | 0None detected | 0None detected | MEDIUM | 0 members/subscribers/owners; Team + SharePoint; retirement candidate after validation. |
| SKA [email protected] | 8
| 1
| MEDIUM | 8 members, 1 subscriber. |
| PTTEP MAINTENANCE CONTRACT [email protected] | 4
| 2
| MEDIUM | 4 members, 2 subscribers. |
| MSA ROTATING GPS [email protected] | 1
| 1
| HIGH | External-only member/subscriber; 0 owners; Team + SharePoint. |
| MSA ROTATING PDB [email protected] | 1
| 1
| HIGH | External-only member/subscriber; 0 owners; Team + SharePoint. |
| PCARD [email protected] | 0None detected | 0None detected | MEDIUM | 0 members/subscribers/owners; Team + SharePoint; retirement candidate. |
| PPE Petronas [email protected] | 1
| 1
| HIGH | External-only member/subscriber; 0 owners; Team + SharePoint. |
| PCOGD TA26 Rotating [email protected] | 4
| 0None detected | MEDIUM | Current project group; 4 internal members. |
| FORUM 22 [email protected] | 0None detected | 0None detected | MEDIUM | 0 members/subscribers/owners; Team + SharePoint; 1 MB observed. |
| Interview 15June 2021 [email protected] | 0None detected | 0None detected | MEDIUM | 0 members/subscribers/owners; Team + SharePoint; 1 MB observed. |
| SBA 2021 [email protected] | 0None detected | 0None detected | LOW | 0 members/subscribers/owners; SharePoint 0 MB; not Team-enabled; strongest retirement candidate after retention check. |
| SBA TENBEX - Execute [email protected] | 0None detected | 0None detected | MEDIUM | 0 members/subscribers/owners; Team + SharePoint; 1 MB observed. |
| TENBEX SBA PCSB [email protected] | 3
| 3
| HIGH | 0 owners; Gmail address confirmed GuestMailUser; Afif/Anita are enabled non-mailbox Users. |
| PTTEP MEETING [email protected] | 2
| 1
| MEDIUM | 2 members, 1 subscriber. |
| SIREP Sharing Folder [email protected] | 3
| 0None detected | MEDIUM | 3 internal members. |
| SIReP FEED Documents [email protected] | 1
| 0None detected | MEDIUM | 1 internal member. |
| TENBEX HSE QUESTIONNAIRE [email protected] | 1
| 0None detected | LOW | 1 internal member. |
| EPCC [email protected] | 10
| 0None detected | MEDIUM | 10 internal members. |
| Self-Installed & Relocatable Platform (SIReP) [email protected] | 14
| 1
| HIGH | 14-member core SIReP group; enabled non-mailbox Johari identity is subscriber. |
| SIReP - TENBEX & NRE [email protected] | 9
| 4
| HIGH | 9 members; 4 external members and all 4 are subscribers. |
| Testing [email protected] | 1
| 0None detected | MEDIUM | Single enabled non-mailbox User; likely test/legacy group. |
| UTP013/2026(T3) [email protected] | 4
| 0None detected | MEDIUM | 3 individual internal users + 1 functional UserMailbox. |
| SEAH LCOT Split-Unit MEC/SVS/201837 Meeting [email protected] | 2
| 1
| HIGH | 0 owners; legacy Shahiffudin object is member + subscriber. |
| red [email protected] | 1
| 1
| HIGH | Owner, member and subscriber are the same legacy Shahiffudin non-mailbox identity. |
Distribution Group — General Tenbex
General Tenbex — [email protected]
76 direct objects were observed in the pasted PowerShell membership output. External MailUsers explicitly preserved in the audit record:
- Msallehuddin — [email protected]
- VickieG — [email protected]
- Sofian Hamila — [email protected]
- NURFARHIN.MATORI — [email protected]
- SHUKORSEMAN — [email protected]
- Shahiman personal Gmail — [email protected]
- Khairi Adzman — [email protected]
- Suzi — [email protected]
The current retained audit record preserves the 76-object total and these external addresses, but not the complete 76-name roster. Re-exporting this DG to CSV is recommended for a complete CEO annex.
Identity Governance Findings
Legacy Shahiffudin identity
Legacy non-mailbox User: [email protected]
Object ID: d116c616-b695-4806-92e7-55f200e7848a
AccountDisabled observed: False
Separate current mailbox: [email protected]
Object ID: ef69cba6-ff11-4de8-b83d-0a1479e1dc13
The legacy object remained a member of PTTEP, red and SEAH-LCOT; in red it was owner + member + subscriber.
Other enabled non-mailbox Users
- Mohamad Afif Mohd Shahimee — [email protected]
- Anita Mokhtar — [email protected]
- Mohd Aiman bin Md Tasyrif — [email protected]
- Mohamad Johari bin Dasri — [email protected]
For all four, Exchange showed RecipientTypeDetails=User, no Primary SMTP and AccountDisabled=False. This is not by itself proof that interactive Entra sign-in is enabled.
Ownerless Microsoft 365 Groups
| Group | Members | Subscribers | Owners | Conclusion |
|---|---|---|---|---|
| [email protected] | 3 | 3 | 0 | External Gmail GuestMailUser + non-mailbox users. |
| [email protected] | 2 | 2 | 0 | Non-mailbox identities. |
| [email protected] | 2 | 1 | 0 | Legacy identity; Team + SharePoint. |
| [email protected] | 1 | 1 | 0 | External-only. |
| [email protected] | 1 | 1 | 0 | External-only. |
| [email protected] | 1 | 1 | 0 | External-only. |
| [email protected] | 0 | 0 | 0 | Team + SharePoint; retirement candidate after validation. |
| [email protected] | 0 | 0 | 0 | Team + SharePoint. |
| [email protected] | 0 | 0 | 0 | SharePoint 0 MB; not Team-enabled; strongest retirement candidate. |
| [email protected] | 0 | 0 | 0 | Team + SharePoint. |
| [email protected] | 0 | 0 | 0 | Team + SharePoint. |
| [email protected] | 0 | 0 | 0 | Team + SharePoint. |
CEO Governance Conclusions
Current practice
- Shared Mailboxes for HR/Admin/Procurement/Sales are a good technical pattern.
- Group lifecycle governance is inconsistent.
- External access and personal Gmail exist in collaboration groups.
- Parallel functional groups make authoritative access unclear.
- Legacy identities were not consistently retired when newer mailbox identities existed.
Required governance
- One canonical identity per employee.
- Shared Mailbox for multi-user general inboxes; no shared passwords.
- At least two accountable owners for retained M365 Groups/Teams where practical.
- Business approval + expiry/review date for external guests.
- Quarterly access certification for general/sensitive resources.
- Project closeout SOP covering email, Teams, SharePoint and guest access.
- Central Email & Group Register.
Evidence limitation: This report does not invent missing data. The complete 76-member roster of General Tenbex is not reproduced because the retained conversation record does not contain the complete raw list. Re-export it before final CEO sign-off if a complete person-by-person annex is required.