How Ownership Gets Lost

Most of the ownerless groups I have gone looking for had an owner once.

I have done this work at a few different organizations: defining Active Directory groups well enough that they could be reviewed. Before anyone can review a group, someone has to own it, so we went looking.

Usually all we had was the group's name. Once in a while we could trace it back to the ticket that requested it. When there was no ticket, we reached out to the most senior person who held it. For groups created years ago, this was painful. Accounts were no different.

That ownership had not gone missing when the groups were created. It went missing afterward.

The owner left the company, and nothing moved their groups to anyone else. The owner changed jobs, and their name stayed on groups they no longer thought about. The team a group served was reorganized, split, or renamed. The company acquired another one, and a whole set of groups and accounts arrived with owners nobody on this side had ever met.

Each of those is a normal business event. None of them, on its own, triggers anything in identity. So ownership wears away a little with each one, and nobody notices until someone needs to review the access.

Most admins today know to add an owner when they create a group. The hard part is everything created before that habit existed, and everything whose owner has moved on since.

Leading that cleanup takes a few decisions nobody else is in a position to make.

Decide what happens to a group nobody claims. Without that rule, the search never ends, and the unclaimed groups keep granting access while you look.

Put group creation and ownership changes through change control, and record the owner and purpose where the next person will look. The hunts I described were hard because the ticket was the exception.

Stop the backlog from refilling while you work it down. When someone leaves or changes jobs, what they own moves to a named person as part of that change. When a team is reorganized, its groups move with it.

In an acquisition, find out who owns what while the people who know are still there.

And do not let AI agents start the same pattern. When the person who set one up leaves, the agent keeps running. Give every agent a named owner the day it is created, and include it in the same handoff as everything else that person owns.

Every one of those hunts would have been shorter if ownership had moved when the owner did.

Related

• Series 1 Post 4: LinkedIn post
• Series 1 Post 6: LinkedIn post
• Series 3 Post 2: LinkedIn post
• Series 3 Post 4: LinkedIn post