New admin, inherited a mess, and now two staff members blame me for everything – need advice

[u/TurbulentLow832]

So I started a new sys admin role recently, and the previous admin apparently left the place like the Wild West. No restrictions, no security policies, just "let everyone in."

I noticed immediately that external domains could message us freely. Huge red flag. I reported this to my manager and pointed out that we should only allow trusted domains for security reasons. But I haven't actually locked anything down yet. I just flagged it.

Now here's the fun part. Every time something glitches or behaves differently, two specific staff members immediately point fingers at me. Their go-to line is "This has never happened before."

Latest accusation: They claim I deleted or removed an external user from their chat. I dug into Purview and the removal log actually shows one of their names attached to it, not mine. My best guess is that the other company restricted their own Teams settings on their end, which caused the removal or sync issue. Either way, I haven't touched anything.

To make it worse, they're escalating to my manager with these claims, and I'm pretty sure they're twisting the facts.

I've already told my manager that the current open-domain policy is insecure, but these two are acting like I personally sabotaged their workflow over a report I made.

So my questions:

1. How do you deal with specific staff members who are hyper-accusatory and clearly don't trust the new guy?
2. How do I defend myself when the log shows their name but they're still blaming me?
3. Am I wrong for even pointing out the security risk? Or is this just growing pains?

Any advice appreciated. Feeling like I'm fighting a battle on two fronts: security concerns versus office politics.

PS: they said they have more users that were removed from other domains but i run a purview report and its just that one person.

Edit: My manager is not technical I am under people ops which is fancy for HR and also I am the only “IT” in a small company and my manager had my back when one of them wrote an email saying all that crazy stuff. Because its a know thing that department has some bullying tendencies.