For many businesses, the most valuable “network perimeter” is now a username and sign-in screen. Email, cloud storage, accounting systems, CRM platforms, and remote tools can all be reached without ever touching the office firewall.

MFA remains essential, but identity security has moved beyond simply turning on an authenticator app. Strong programs consider how accounts are created, what they can access, which devices are trusted, how risky sign-ins are handled, and how quickly access disappears when someone changes roles or leaves.

What to focus on first

Separate daily and administrative identities

People who administer Microsoft 365, Google Workspace, servers, firewalls, or backups should not use those privileged accounts for routine email and web browsing. Separate identities reduce exposure.

Use stronger authentication where risk is higher

Prioritize phishing-resistant authentication for administrators, finance staff, executives, and anyone with broad access. Passkeys, FIDO2 security keys, and platform credentials such as Windows Hello can reduce reliance on phishable codes and prompts.

Apply least privilege

Give people the access their role requires and review it when responsibilities change. Permissions tend to accumulate unless someone deliberately removes what is no longer needed.

Add context to sign-in decisions

Conditional access can consider device compliance, location, user risk, and the sensitivity of the application. A normal sign-in from a managed laptop should not be treated exactly like an unfamiliar device in a new country.

Make offboarding a security process

Disable accounts promptly, revoke active sessions, recover company devices, rotate shared secrets, and review application ownership. Departures are one of the easiest places for forgotten access to linger.

Common ways this goes wrong

• Giving multiple people permanent global-admin rights “just in case.”
• Using MFA on email but leaving VPNs, remote tools, or third-party SaaS accounts unprotected.
• Assuming a disabled mailbox automatically removes access to every external application.

Make it part of normal operations

Treat this as a recurring operating responsibility, not a one-time project. Review the control after major account, application, network, or staffing changes; keep ownership clear; and make sure important exceptions are written down. A small business does not need a complicated governance program, but it does need to know who notices when a protection stops working and who has authority to fix it.

Questions worth bringing to your next IT review

• Can we explain how the ‘Separate daily and administrative identities’ practice works today without relying on one person’s memory?
• Where do we have exceptions to ‘Use stronger authentication where risk is higher’, and are those exceptions still necessary?
• Who owns the work behind ‘Apply least privilege’, and what evidence shows it is working?
• How would we discover that this control or process stopped working?
• What business, staffing, vendor, or technology change should trigger another review?

What a solid approach looks like

Good identity security feels boring in daily use: people can reach what they need, unusual sign-ins are challenged, privileged access is uncommon, and changes in employment status are reflected quickly. The complexity stays behind the scenes instead of becoming the employee’s problem.

If you want to go one level deeper, see MFA Fatigue Attacks.

If your organization would benefit from help reviewing the current environment or turning these ideas into a workable plan, Managed Endpoint and Server Protection from CTResources is available as a practical next step. The goal is to strengthen what matters without adding unnecessary complexity.