Finding Orphaned Shared-Mailbox Access After Offboarding

Research question: Does a direct inventory of mailbox owners, delegates, aliases, forwarding rules, and automated routing find unresolved access that a closed offboarding ticket misses?

Methodology: Construct twenty-eight synthetic offboarding cases across shared inbox patterns. Seed removed personal accounts with surviving delegation, ownerless mailboxes, stale forwarding, reassigned queues, closed tickets without evidence, and verified controls. Reviewers examine either the ticket record or the direct inventory, then compare dispositions.

Scope and measures: The unit is one mailbox access path. Count confirmed removals, false closures, orphaned ownership, unresolved routing, reviewer agreement, and review time by access type.

Inference limits: Results can compare the two review methods on the seeded cases. They cannot show that every account in a live environment has been discovered, that a vendor removed cached access, or that no message was retained elsewhere.

Limitations and use: Synthetic cases omit vendor-specific behavior, legal holds, incident response, and informal account sharing. Security and system owners may use the findings to set closure evidence. They still decide access, retention, investigation, and exceptions.

Sources consulted: NIST Cybersecurity Framework 2.0 (https://www.nist.gov/cyberframework); NIST Privacy Framework (https://www.nist.gov/privacy-framework); U.S. Government Accountability Office, Standards for Internal Control in the Federal Government (https://www.gao.gov/products/gao-14-704g); Google Search Central, Article structured data (https://developers.google.com/search/docs/appearance/structured-data/article); Sitemaps protocol (https://www.sitemaps.org/protocol.html). These sources supply general control, privacy, and publishing concepts. They do not report results for Outsourced Employment, create legal or employment requirements, guarantee search indexing, or validate a live workflow.