Fix list · Tab & Shift EngineeringFloor 16 Technologies
Fix list · from the Scan
What to fix first, and why
Tab & Shift Engineering Ltd. · companion to the Microsoft 365 Maturity Assessment
| Prepared for | Prepared by | Date | Status |
|---|---|---|---|
| Priya Shah Director of Operations | Floor 16 Technologies | Apr 24, 2026 | v1.0 · Issued |
Summary
27 fixes, in the order we would do them. The first eight take about two days, need no licensing and no outside help, and close the exposure that matters most this week.
8fixes this week, no licensing, no prerequisites
27fixes in all, each one priced and done on its own
1licensing decision, and only item 19 waits on it
The order follows three rules. Close what is exposed before tidying what is messy. Write the rule before acting on content, which is why the retention schedule comes before any archive or deletion. Fix access before switching AI on, because AI answers from whatever a person can open.
Each fix carries its impact, the working time it takes, who does it and what it depends on. Effort is working time, not elapsed time. Items marked Floor 16 can equally be done by Tab & Shift's own IT or its managed service provider; the list is Tab & Shift's either way. The reasons behind each item are in the maturity report.
Impact against effort
Item numbers from the tables below. Deep Sky marks item 2, the single largest exposure in the tenant.
Higher impact
Do first
123459101821
Plan
13171920232526
Lower impact
Fit in
67811151622
Schedule
12142427
Lower effort
Higher effort
The list
This week
No licensing · no prerequisites · about two days| # | Fix, and why | Impact | Effort | Who | Depends on |
|---|---|---|---|---|---|
| 1 | Turn off Anyone links; guest links expire in 30 days212 links need no sign-in and never expire. Every other sharing fix is undone if new ones keep appearing, so this goes first. | High | 1 hour | Sam Okafor | None |
| 2 | Remove Everyone from HR Team and HR Records 20197,900 HR files open to all 90 staff, and to Copilot for any of them. The largest single exposure found. | High | 1 hour | Sam Okafor, Elena Rossi | None |
| 3 | Lock the Payroll folder to the three people who run payroll1,900 payroll files open to 26 people, 9 of them outside finance. | High | 30 min | Sam Okafor, Marcus Chen | None |
| 4 | Disable and delicense the 9 former staff accountsNine sign-ins nobody watches. One reaches 52 sites. About $1,350 a year in seats. | High | 2 hours | Sam Okafor | None |
| 5 | Revoke the 74 Anyone links that allow editingAnyone holding the link can change client files. Re-share deliberately where the link is still needed. | High | Half day | Sam Okafor | 1 |
| 6 | Restrict user consent to third-party appsThree AI tools were connected to staff accounts without anyone deciding. Admin approval stops the next one. | Medium | 1 hour | Sam Okafor | None |
| 7 | Move the 5 flows owned by former staffThree have failed every run since February, and nobody was told. | Medium | Half day | Sam Okafor | None |
| 8 | Reassign the 3 unused Copilot seats to Bids and ProposalsPaid for and unused. Bids is the likely pilot team, so the seats start earning now. | Low | 30 min | Priya Shah | None |
Next 90 days: clean up
May to Jul 2026| # | Fix, and why | Impact | Effort | Who | Depends on |
|---|---|---|---|---|---|
| 9 | Write and sign the retention scheduleThe lowest score in the report (1.2). Nothing can be archived or deleted safely until the rule exists. One page: record type, trigger, period, owner. | High | 1.5 days | Floor 16 drafts, Marcus Chen signs | None |
| 10 | Agree the archive dateOne decision moves 322,000 files out of the working set. We suggest content untouched since Jan 2023. | High | 1 meeting | Priya Shah, Marcus Chen | 9 |
| 11 | Name two owners for every site that stays9 sites have no active owner and 31 have one. Owners sign off the archive and retire decisions that follow. | Medium | Half day | Priya Shah | None |
| 12 | Remove 38,400 duplicate files, keeping the authoritative copy210 GB. Done before the archive so it is built once, and so owners settle which copy is current. | Medium | 1 day | Floor 16, site owners | 11 |
| 13 | Move content older than the archive date to a read-only archiveWorking set from 520,000 files to about 160,000. Storage from 1.68 TB to about 0.8 TB. Structure kept, still searchable, nothing deleted. | High | 2.5 days | Floor 16 | 9, 10, 12 |
| 14 | Retire 34 dormant, test and duplicate sites78 sites become 44. Fewer places for people, and AI, to look. | Medium | Half day | Floor 16, site owners | 13 |
| 15 | Set version history limits on the five largest sites380 GB of the storage used is old versions. | Medium | Half day | Sam Okafor | None |
| 16 | Cancel 15 unused add-on seats at renewalProject, Visio and Power BI seats nobody has opened in 90 days. About $3,700 a year. | Low | 1 hour | Marcus Chen | None |
Lock down
Jun to Sep 2026 · one licensing decision| # | Fix, and why | Impact | Effort | Who | Depends on |
|---|---|---|---|---|---|
| 17 | Replace the remaining Everyone grants with named groupsAfter items 2 and 14, about 40 grants remain. The median account reaches 29 sites today; AI reach follows the same lines. | High | 1.5 days | Floor 16, site owners | 11, 14 |
| 18 | Decide Business Premium for the 63 Business Standard staffAnyone who opens a protected file needs a license that covers it, so labels cannot be applied to part of the company. About $6,000 to $8,000 a year at list price. | High | 1 meeting | Marcus Chen | None |
| 19 | Publish six sensitivity labels with library defaultsZero labels today. Labels are what Copilot, Claude and ChatGPT connectors are tested against. Library defaults need a Purview add-on, sized with the reseller. See the sample label set. | High | 2 days | Floor 16 | 18 |
| 20 | Publish retention policies from the scheduleThe ten-year project rule becomes a setting rather than a PDF. | High | Half day | Floor 16 | 9 |
| 21 | Turn on restricted content discovery for HR, finance and leadership sitesKeeps those sites out of Copilot and company search for people who do not work in them. Already included with the Copilot seats Tab & Shift owns. | High | 2 hours | Sam Okafor, Floor 16 | 2, 3 |
| 22 | Guest expiry and a twice-yearly owner checkKeeps access right after the cleanup instead of drifting back. | Medium | Half day | Sam Okafor | 11 |
Build and AI
Jul 2026 to Mar 2027| # | Fix, and why | Impact | Effort | Who | Depends on |
|---|---|---|---|---|---|
| 23 | Project register to replace the spreadsheetFour copies of the project list; billing and operations work from different ones. One register, one set of numbers. | High | 6 to 8 days | Floor 16, Priya Shah | 10 |
| 24 | Expense approvals with receipts attached240 claims a month, 9 days median to pay, approvers signing without receipts. | Medium | 3 to 5 days | Floor 16, Marcus Chen | None |
| 25 | Job sheet capture from crew phones1,100 job sheets a month arrive as photos and are typed into billing, sometimes twice. | High | 3 to 5 days | Floor 16, Luis Ortega | 23 |
| 26 | AI Boundary CheckAsk the AI for things it should not find, before anyone relies on it. See the sample boundary report. | High | 3 days over 2 weeks | Floor 16, Sam Okafor | 17, 19, 21 |
| 27 | Pilot with Bids and Proposals, then the restOne team on real work, measured at 30 and 60 days, before any seats are added. See the sample rollout plan. | Medium | 2 days over 6 weeks | Priya Shah, Floor 16 | 26 |
Who carries the work
Most of the early work sits with Tab & Shift's IT coordinator and takes hours, not weeks. The heavier items are the ones Floor 16 would price, one at a time.
Tab & Shift staff timeFloor 16 time, estimated
Bar length scaled to 33 working days. Floor 16 time is an estimate until each item is priced.
What we would not do yet
| Not yet | Why not | When it makes sense |
|---|---|---|
| Buy more Copilot seats | Four of ten are used weekly. More seats would find the same open HR sites. | After the pilot shows who uses it daily |
| Delete anything | There is no retention schedule, so nobody can say what is allowed to go. Archiving is reversible. | After item 9, and only with the owner's sign-off |
| Redesign the project sites | The register and the archive change what is left to organize. Design follows them. | After item 13, through a short discovery |
| Auto-label the whole tenant | Library defaults on the sensitive sites cover most of the risk with far less disruption. | Once labels have run for a quarter |
| Build an intranet | Communication is not where the scores are low. | Revisit at the twelve-month reassessment |
How to use this list. Every item stands on its own. Do the first eight this week whether or not anyone else is involved. For the rest, tell us which items you want priced and you get a fixed price for each before any work starts.
Sample on a made-up company. Tab & Shift Engineering Ltd. and everyone named here are fictional. Figures are scenario numbers, rounded. Real engagements use the client's own tenant data.