Review a shared task list by identifying its owner, every current member, every still-active invitation path, and the account that controls organizational settings. Then confirm that each person needs the access they have. The visible member list is the starting point, not the whole review.
Identify how people can join
Open the sharing or access panel for each list. Record the owner, current members, pending invitations, and whether an invitation link still accepts new participants. Also note whether the list sits in a personal account, a work account, or an education account because organizational controls may affect sharing and data handling.
Microsoft To Do uses an invitation link for list sharing. Its support page says an owner can limit access to current members so nobody else can join through the existing link, or stop sharing so current members lose access and the list becomes private again. Review those controls at Microsoft Support. If a link was posted in a broad channel or sent to people who no longer participate, limit or replace it after preserving any required record of the change.
Match members to a real purpose
For each participant, record why access is required, what assignments they own, and when the need ends. Remove former team members and duplicate accounts. If the app does not offer separate viewer and editor roles, treat list membership as edit-capable unless a test proves otherwise. Never infer a permission solely from the label shown in a notification.
Check shared tasks for personal details, customer information, access codes, or sensitive notes that do not belong in a general work list. Google states that personal Tasks content remains private unless the user chooses to share it, and that administrators of managed accounts may restrict downloading user data. See Google Tasks privacy information. This makes the account context and sharing decision part of the review.
Check ownership and recovery
Confirm that the owner is an account the team expects to retain. A list controlled only by a departing employee or an unmanaged personal account can become difficult to maintain. Document who can restore normal work if the owner is unavailable, but do not create a shared password. Prefer a supported ownership-transfer or organization-managed account feature when the service provides one.
Apply the same restraint to integrations. Inventory calendar connections, email add-ins, automation tools, and mobile devices that can display or modify tasks. Remove connections that have no current owner. CISA recommends periodically reviewing whether accounts are still needed and limiting permissions to what each account requires. See CISA's account guidance.
Verify the result safely
After making approved changes, test with a non-sensitive sample list. Confirm that a current member can open and update the expected items, a new person cannot join through a disabled link, and a removed member no longer sees the list. Check more than one device if the service caches offline data, but do not delete a former user's device data remotely unless that action is separately authorized.
Finish with a dated record of the owner, members, invitation status, connected services, removed access, unresolved exceptions, and next review date. A clean result means the list is usable by the right people, closed to everyone else, and recoverable without relying on a single undocumented account.
Sources
- Create and share lists — Microsoft
- How Tasks protects your privacy and keeps you in control — Google
- Enhanced Visibility and Hardening Guidance for Communications Infrastructure — Cybersecurity and Infrastructure Security Agency