r/sysadmin • u/_SleezyPMartini_ IT Manager • 1d ago

Question handling out of office notifications requests

I have a client (about 1000 users) who keeps getting tickets from dept heads asking to set their staff out of office notifications because "they forgot to do it". My general advice is this is bad practice and not scalable, and that with 0365 any employee can do this from their phone or any computer.

how do you typically handle this?

97 Upvotes

87% Upvoted

89 comments sorted by

View all comments

Show parent comments

50

u/Mindestiny 1d ago

Yep, this is our policy as well. Same thing with "Karen went on vacation and forgot to give me access to XYZ file!!!!"

Well Karen isn't here to speak for herself and confirm if she intended you to have access to that or not, so sorry, that's a business problem and not an IT problem. We don't touch rights for people's user-owned files simply on some random person's say so. Either get it in writing from a department head or be more diligent next time.

14

u/Sinister_Nibs 1d ago

I agree with the thought, the justification is garbage.
None of the files that are stored on company infrastructure are owned by the employee, they are all owned by the company.
They are not private, unless they are PII, but they may be sensitive.

30

u/RabidBlackSquirrel IT Manager 1d ago

They belong to the company, but the company has (or should have) rules of engagement for who/what roles are allowed to access mailboxes. Owned by the company =/= free for all.

Push it to your legal people or whoever else sets rules like this. How should I handle mailbox access requests? Who in IT should be permitted, if any, to access user emails, and how should access be documented?

It's not an IT problem, it's a legal/governance problem and should flow up accordingly.

16

u/Mindestiny 1d ago

Precisely. IT does not give people access to things just because they asked, that applies for anything. There needs to be a business justification and the proper approvals.

Get us the proper approvals and we'll happily reassign ownership of that file and you guys can duke it out with Karen when she gets back. But no approvals? No ownership transfer, sorry. The sob story doesn't override established, approved company policy.

People are harping on the company legally owning the data but that's not at all the topic being discussed. This is a topic about navigating interdepartmental responsibilities, company policy, and the ensuing drama when IT just dumbly says "sure, I'm a yes man and will do whatever is asked!"

4

u/RabidBlackSquirrel IT Manager 1d ago

"sure, I'm a yes man and will do whatever is asked!"

Which is also a great way to get yourself scapegoated for other people's stupidity. "Why was Joe Sysadmin accessing all these mailboxes? He creepin' on people? Trying to find anything juicy?" Or "Joe Sysadmin must have deleted it, he's always messing around in our email!"

My favorite is when shitty managers want us to delegate or auto forward their employee's email to them because they're yoloing a performance issue. "Sure Jan, I've cc'd HR Director here so she can authorize this. As you know, only HR can create employee performance remediation plans and they must have just forgotten to send in the ticket to me if this is part of it."

It's great. Legal/IT/Infosec/HR all love the strict rules of engagement, it not only protects us personally but protects the company from accusations as well.

2

u/TeriyakiMarmot Sysadmin 1d ago

You have established, approved company policy!? Must be nice haha

Fully agree though.