Identity, MFA & Access for Small Business
Section updated .
Small-business identity security comes down to four controls: multi-factor authentication on every account that matters, session and token control so a stolen sign-in does not live forever, a password manager with passkeys where available, and a joiner-mover-leaver process that closes accounts when people go. Most breaches of small firms start with a valid login, not a technical exploit.
For a business with Microsoft 365 or Google Workspace, the identity system is the front door, the safe and the filing cabinet at once. An attacker who gets one administrator sign-in can read mail, change payment details and delete backups without touching a single server.
These guides cover the controls in the order they pay back: turn on MFA properly, shorten the life of stolen sessions, make strong credentials easy to use, and keep the account list true as people join, move and leave.
Guides in this section
MFA for everyone, admins first
Which second factors resist phishing, how to roll them out, and the mistakes that leave gaps.
Read the guide →Session and token control
Why a stolen session cookie can bypass MFA, and how to shorten and revoke sessions.
Read the guide →Password managers and passkeys
Make strong, unique credentials the easy path for staff, and know where passkeys fit.
Read the guide →Joiners, movers and leavers
A short process that stops former staff and forgotten accounts becoming an open door.
Read the guide →How to work through this section
Begin with MFA for everyone, starting with administrators. Then read session and token control to limit what a stolen session can do. Roll out a password manager and passkeys, and put the leaver checklist in front of whoever handles departures.
Tuesday is identity day in the daily briefing: review sign-in alerts and the administrator list every week.
Frequently asked questions
Is SMS-based MFA good enough?
It is far better than a password alone, but codes sent by text or typed from an app can still be phished. Phishing-resistant methods such as passkeys and hardware security keys are stronger; use them first for administrators and finance staff.
Can attackers bypass MFA?
Yes, in some cases: by tricking a user into approving a prompt, by relaying a sign-in page, or by stealing a session that is already signed in. The session-control guide covers how to limit this.
What should happen when an employee leaves?
Disable the account, revoke sessions and tokens, remove access to shared tools and payment systems, collect devices, and keep mail and files per your retention rule. The leaver checklist lists the steps.
Do small businesses need a password manager?
A business password manager lets staff use unique, strong passwords without memorising them, and lets you remove access when someone leaves. It is one of the lowest-cost identity controls available.
Be first when the email edition starts
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.