Microsoft 365
Identity protection: securing accounts as the new perimeter
For a business running entirely in Microsoft 365 and SaaS, there is no network perimeter left to defend — the only thing standing between an attacker and your data is an identity and what it is allowed to do. Identity protection means four disciplines: keeping privileged accounts few and separate, removing access the moment someone leaves, controlling non-human accounts, and verifying who you are talking to before you change anything. Most small business breaches trace back to a failure in one of those four, not to a missing security product.
Key facts
- In a cloud-first business, an account credential is functionally the entire perimeter.
- Dormant accounts belonging to leavers are among the most commonly exploited entry points.
- Service accounts often cannot use MFA and are frequently over-privileged and never rotated.
- Standing administrative access is a larger risk than weak passwords in most small tenants.
- Session tokens survive a password reset — access revocation requires explicit session revocation.
- Helpdesk identity verification is a control, not a formality; it is the target of most social-engineering attempts.
- Access reviews are more effective than access requests at controlling permission creep.
Privileged access: fewer, separate, temporary
Three principles cover most of what a small business needs. Fewer: count your Global Administrators today and reduce the number to the minimum that works, usually two plus break-glass. Separate: administrative work happens from a dedicated account that does not read email or browse the web. Temporary: where your licensing supports it, privileged roles should be activated when needed rather than held permanently.
Small businesses resist all three because they feel bureaucratic at ten people. The counter-argument is simple: the cost of applying them is an hour of setup and a minor daily inconvenience for one or two people, and the cost of not applying them is that a single phished email in the owner's inbox becomes full control of the company's entire information estate.
Joiners, movers and leavers — the process that quietly protects you
Most small businesses have a joiner process because a new person cannot work without one. Very few have a leaver process, because nothing visibly breaks when you skip it. That asymmetry is why dormant accounts accumulate.
A leaver process needs to run on the day, not the week after. Disable the account rather than deleting it, revoke all sessions immediately, remove MFA methods, convert the mailbox to shared if colleagues need continuity, reassign OneDrive ownership before the retention window closes, remove the licence once data is secured, and — the step almost everyone forgets — remove them from SaaS applications that are not connected to your Microsoft sign-in. Those standalone tools are where ex-employee access most often survives.
Movers matter too, and are handled worse than leavers. Someone who transfers from finance to operations typically keeps every permission they had and gains new ones. Over five years, a long-serving employee accumulates access to nearly everything, which makes their account a disproportionately valuable target. A twice-yearly access review — managers confirming what their people actually need — is the practical remedy.
- Disable, do not immediately delete
- Revoke sessions and remove MFA methods the same day
- Convert the mailbox to shared for continuity
- Transfer OneDrive ownership before retention expires
- Remove access from SaaS tools outside single sign-on
- Collect or remotely wipe company data on devices
- Reset any shared credential the person knew
Service accounts and other non-human identities
Every business has them: the account the backup software uses, the mailbox the website sends from, the integration between the CRM and the accounting system. They are rarely inventoried, usually over-privileged, frequently exempt from MFA because they cannot present a factor, and their passwords typically have not changed since the system was installed.
Start by listing them, because most businesses cannot. For each one, establish what it is for, who owns it, what permissions it genuinely needs, and how it authenticates. Then reduce permissions to the minimum, move to a modern authentication method such as a managed identity or an application registration with certificate credentials where possible, and put a rotation date on anything still using a password.
Where a service account must remain exempt from MFA, compensate elsewhere: restrict it to specific IP addresses through Conditional Access, alert on any interactive sign-in to it, and ensure it cannot be used to sign in to a workstation.
Verification before action
The weakest link in identity security in most organisations is not technology, it is the moment a support process decides it is talking to the right person. Every credential reset, MFA re-registration and permission change is an opportunity for someone to impersonate an employee.
A verification standard should be written down and applied without exception, including for senior people — especially for senior people, because urgency and authority are the two levers social engineers pull hardest. Verification must use a channel independent of the one making the request: a callback to a number already on file, confirmation from a line manager, or an in-person check. An email confirmation from the account being reset proves nothing.
Sessions, tokens and the myth of the password reset
Resetting a password does not evict an attacker. Modern authentication issues refresh and access tokens that remain valid independently of the password, which is why a compromised mailbox can continue to be read after the user has changed their credentials and re-registered MFA.
The complete sequence after a suspected compromise is: reset the password, require MFA re-registration, revoke all sessions, review and remove inbox rules, review consented OAuth applications, check for added authentication methods and check for delegated mailbox permissions. Skipping the last four is how a business gets compromised twice by the same intrusion.
What businesses most often get wrong
- Leaving leavers' accounts enabled because nothing appears to break
- Running day-to-day work from a Global Administrator account
- Never inventorying service accounts, then exempting all of them from MFA
- Verifying identity over the same channel the request arrived on
- Treating a password reset as complete remediation for a compromised mailbox
- Granting permissions on request and never reviewing them again
Where AlwaysOnIT fits — and doesn't
Identity work is the core of what we do: resets, MFA re-enrolment, access changes and leaver actions, each preceded by an identity check and written to an audit trail. We operate with zero standing access — credentials are brokered per task and expire. We do not run privileged access management programmes or periodic access reviews on your behalf; we will tell you what to review and when, but the review is yours.
Frequently asked questions
Identity protection — common questions
Why is identity called the new security perimeter?
Because for a cloud-first business there is no network boundary left to defend — data sits in Microsoft 365 and SaaS platforms reachable from anywhere. What determines whether someone gets in is whether they can present a valid identity and what that identity is permitted to do, which makes account security the primary control rather than one of several.
What should be on a leaver checklist?
Disable the account, revoke all sessions, remove registered MFA methods, convert the mailbox to shared if colleagues need it, transfer OneDrive ownership, remove or reassign the licence once data is secured, remove access from SaaS tools outside single sign-on, wipe or collect company data on devices, and reset any shared credentials the person knew.
How do I secure service accounts that cannot use MFA?
Inventory them first, then reduce each to the minimum permissions it needs. Move to managed identities or certificate-based application registrations where the platform supports it. For accounts that must keep a password, restrict them to known IP addresses through Conditional Access, alert on interactive sign-ins, block workstation sign-in, and set a rotation schedule with an owner named against each one.
Does changing a password remove an attacker from an account?
Not on its own. Session tokens issued before the reset remain valid, so an attacker can retain access. You must also revoke sessions, remove any MFA methods they registered, delete inbox rules they created, and review OAuth applications they consented to — those are the usual persistence mechanisms.
How often should a small business review who has access to what?
Twice a year is a realistic cadence for a small business, with managers confirming what their team members actually need rather than IT guessing. Run it alongside the quarterly licence review — the two exercises use the same data and finding a dormant account is both a security fix and a cost saving.
Read next
Multi-factor authentication: the control that matters most, done properly
How MFA works, why SMS codes are the weakest common method, MFA fatigue and number matching, phishing-resistant options, and how to roll it out without chaos.
Conditional Access: policies a small business should actually deploy
A practical Conditional Access baseline for UK SMEs: which policies to deploy first, how to avoid locking yourself out, report-only mode, and licensing requirements.
Business email compromise: how the invoice fraud actually works
How business email compromise and invoice redirection fraud work in practice, the warning signs, the controls that stop it, and what to do in the first hour.
Get started
Open a chat. The AI picks up before the second ring — every time.
No onboarding calls. No sales process. Connect your devices and start raising tickets in under ten minutes.