You probably already have the problem. A project manager invited a contractor into Microsoft 365 months ago. A vendor needed one SharePoint folder, then got added to a broader team. A client contact joined a Teams channel during a deal cycle and never got removed after the work ended. Nobody