Identity, single sign-on and multi-factor authentication
Stolen passwords are behind a large share of business breaches, and a password alone no longer protects much. We give every person one strong work identity, protect it with multi-factor sign-in that is hard to phish, and use it to sign in to every business app.
Identity, single sign-on & multi-factor authentication for small and medium businesses
Most small businesses have switched on some form of multi-factor authentication and assume the problem is solved. Then we look and find exceptions: a shared mailbox with no second factor, an old protocol that lets anyone with the password straight in, a director who was excused because the prompts were annoying, and a dozen web apps each with its own separate login. Attackers know where to look for these gaps, and they only need one of them to work.
Identity work closes them in order. Every account gets multi-factor sign-in with no exceptions, using the Microsoft Authenticator app, passkeys or physical security keys rather than text messages where we can. Older sign-in methods that bypass those checks are switched off. Conditional access rules then decide when a sign-in is allowed, for example only from managed devices for administrators, or never from countries where you have no staff. Each rule is tested before it is enforced.
Single sign-on is the part staff tend to like. Instead of a different username and password for the CRM, the accounting system and the HR portal, people sign in once with their work account and get into everything. For the business it means leavers lose access to every connected app the moment their account is disabled, and multi-factor protects all of them at once. We connect the apps that support it and list the ones that don't, so you know where the remaining risks sit.
What's included
Sign-in review
A check of every account, sign-in method and exception in your tenancy, with the gaps ranked by how likely they are to be used.
Multi-factor for everyone
Multi-factor sign-in required for every account, including shared mailboxes and service accounts, with a plan for each awkward case.
Phishing-resistant methods
Passkeys, security keys or number-matching app prompts in place of text messages, starting with directors, finance and administrators.
Legacy sign-in blocked
Old email protocols and basic authentication turned off, so a stolen password can't be used to slip past multi-factor.
Conditional access
Rules about which devices, locations and risk levels are allowed to sign in, tested in report-only mode before enforcement.
Single sign-on
Business apps connected to your Microsoft 365 or Google identity, so one sign-in covers them and one switch removes access.
Admin account hygiene
Separate admin accounts, emergency access accounts stored safely and admin rights given only to people who need them.
Sign-in monitoring
Risky sign-ins, impossible travel and repeated failures reviewed, with accounts locked and passwords reset when something looks wrong.
Who is identity and access work for?
Identity work should be near the top of the list if:
- Some accounts or directors are excused from multi-factor sign-in
- Staff approve sign-in prompts they didn't start just to make them stop
- Each business app has its own separate username and password
- Several people have full admin rights to Microsoft 365 or Google
- Your insurer asks whether multi-factor covers every account
- Someone in the business has already had an email account taken over
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkIdentity, single sign-on & multi-factor authentication questions
We already have MFA. Isn't that enough?
It is a big step, but not every method is equal. Text message codes and simple approve prompts can be phished or worn down with repeated requests. Passkeys and number matching are much harder to trick, and conditional access stops a stolen session being reused from elsewhere.
What is conditional access?
It is a set of rules checked at every sign-in, such as whether the device is managed, where the person is signing in from and how risky the sign-in looks. Depending on the answers, access is allowed, challenged or blocked.
Which apps can use single sign-on?
Many business apps support it, including common accounting, CRM, HR and design tools, though some only on higher price tiers. We list your apps, connect those that support it and suggest what to do about the rest.
What licences do we need?
Basic multi-factor comes with every Microsoft 365 and Google Workspace plan. Conditional access needs Microsoft 365 Business Premium or an Entra ID P1 licence. We check what you have before recommending anything extra.
Will this make signing in harder for staff?
Usually it makes it easier. With single sign-on and trusted devices, people sign in less often and to fewer places. Prompts appear when something is unusual, which is exactly when they should.
What happens if someone loses their phone?
We verify who they are, remove the lost device from their account and register a new method, often within minutes. Having a second method or a security key set up beforehand makes this even quicker.
Is this included in a plan?
Multi-factor sign-in and device policies are set and enforced in the Complete plan at $169 per user per month plus GST. On other plans the project is quoted in writing first, and single sign-on for each extra app is scoped separately.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security