SharePoint Online Access and Security Controls Need Improvement

Report Information

Summary

The IRS needs to improve SPO user access and security controls. We reviewed more than 18,000 SPO sites and found that 52 percent were missing audit logs and 47 percent did not report an access control method. Missing audit logs limited site administrators’ abilities to verify and ensure that appropriate access was granted. One percent of sites reported using the Business Entitlement Access Request System as its method of access control. Effective access controls ensure that users only have access to the information they need to accomplish their work. In addition, a scanning tool used by the IRS to identify sensitive information could not be migrated to SPO. This resulted in restricted files and information being uploaded and made accessible to users. SPO sites should not store Personally Identifiable Information or Federal Tax Information. In a sample of 20 sites, we identified 2 sites that uploaded restricted file types, and 7 sites contained sensitive information, which should not have been stored on the sites. The scanning tool has not been redeveloped. Further, SPO reports did not provide sufficient information to ensure that the IRS complied with certain requirements. For example, we identified 686 sites that did not have 2 site administrators as required. In addition, our review of SPO sites with two assigned site administrators found that the site administrators were not always from the appropriate business unit, i.e., from the same business unit as the SPO site. For a sample of 20 sites, 9 had a primary or secondary site administrator that were not from the business unit responsible for the site. Finally, the migration to SPO took 2 years longer than originally scheduled, which resulted in the IRS paying more than $1 million to maintain its older system. These delays were caused by a contractor hired to assist the IRS with certain tasks related to the migration. Due to these delays, the IRS had to pay an extended service contract to maintain the operating system and the SharePoint 2013 servers. This cost approximately $950,00 in Fiscal Year 2024 and $105,000 in Fiscal Year 2025.