Protection · Accounts and permissions
The right access. For the right person.
Review business accounts, sign-in protection and permissions so people can work without leaving unnecessary access behind.
Access follows the job
A person, a role and the access that fits.
The account identifies someone. Permissions determine what they can do.
Role & responsibility
Named account
Know who is signing in
Sign-in protection
Add appropriate verification
Working permissions
Provide the access needed for the role
Administrative tasks
Keep privileged changes deliberate
01 / Identity and access
An account is a key to your business.
Email, files, accounting software and customer systems all depend on knowing who is signing in. Shared passwords and forgotten accounts make that harder. A departing colleague should not retain access simply because nobody owns the task of removing it.
Identity and access work brings those decisions into view. It connects who somebody is, what they need to do and which systems they should be able to use. For a small business, a clear process can make a substantial difference without unnecessary complexity.
02 / Identity and access
Review the basics.
The work begins with an account and permissions review for agreed services. Changes are planned around business roles and the features available in your systems.
- Named accounts and clear ownership of shared resources.
- Multi-factor authentication where appropriate and supported.
- Separate administrative access for privileged tasks.
- A repeatable process for joining, changing role and leaving.
03 / Identity and access
Make stronger sign-in workable.
Multi-factor authentication asks for more than a password when somebody signs in. The suitable method depends on the platform and the people using it. Recovery arrangements need care too: a lost phone should not leave the owner permanently locked out or tempt the team to bypass protection.
Sign-in rules, recovery methods and emergency access should be documented and protected. We review the controls available in your subscriptions and identify any changes needed to support the chosen approach.
04 / Identity and access
Permissions should follow the job.
People often collect access over time. Temporary help with a task becomes permanent access to a folder; an old supplier remains an administrator. A review identifies permissions that are necessary, excessive or no longer understood.
Removing access needs judgement. It may affect business processes or an integration that nobody has documented. The plan should preserve legitimate work while reducing avoidable exposure, with authorised changes and a way to confirm the result.
05 / Identity and access
Retain control of your own systems.
The business should know who owns its domains, core accounts and recovery details. Provider access should be purposeful and appropriate to the service. It should not leave you dependent on an undocumented personal account or unable to change suppliers later.
A clear handover record supports continuity. It can identify the systems, responsible people and secure location of administrative information without putting passwords into ordinary documents or email conversations.
Before we begin
Your questions.
Why use named accounts?
Named accounts make it clearer who can access a system and which permissions they need. They also make it easier to change access when someone joins, moves role or leaves.
Where does stronger sign-in fit?
Multi-factor authentication adds a check beyond the password. It works alongside device protection, sensible permissions, email care and recovery planning.
Start with a conversation