I was reading a post about M365 migrations carrying forward old identity problems, and it...

I was reading a post about M365 migrations carrying forward old identity problems, and it lined up with what I see in the field. Too often the focus stays on moving the mailboxes and data, while the permissions and access that came along get left for later. In the projects I run, we spend real time on the source side before any waves start. Matching accounts correctly and reviewing what has access to what prevents those stale rights from landing in the new tenant. If you skip that step, the target environment starts with the same governance gaps you thought you were escaping. The pilot wave is where this shows up first. Shared mailboxes, delegates, and cross-team resources expose the issues that a simple user test never catches. Once those surface, the remediation work has to happen before the next wave rolls. How do you handle permission reviews when the timeline is tight?