> ## Content Index > Fetch the complete content index at: https://adamjrg.com/llms.txt > Use this file to discover other available public pages before exploring further. # IAM for a Small Company: Where I'd Start - URL: https://adamjrg.com/blog/iam-for-a-small-company-where-id-start/ - Published: 2026-11-08T08:29:00.000Z - Updated: 2026-11-08T08:29:00.000Z - Description: Identity and access management for a small company needs no identity team or enterprise budget. Here is the order I'd do it in. - Author: Adam - Tags: Small business, MFA, Microsoft security, #claude-written When people hear "identity and access management", they picture a big company with a governance platform, a team of analysts and quarterly access certifications. But the question is the same at a company of eight people as at one of eight thousand: who can get in, to what, and who switches them off when they leave. A small company just answers it with fewer tools, and usually without anyone owning it. This is the version I'd hand to a friend running a small business. It's UK-focused, because that's where I am, and it leans on Microsoft 365 because that's what most small firms I come across already pay for. ## Why it matters for small companies The UK government's [Cyber Security Breaches Survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026?ref=adamjrg.com), published in April, is the best picture we have of UK businesses. A few numbers stood out to me: - **42%** of micro businesses (1 to 9 staff) and **46%** of small businesses (10 to 49 staff) reported a breach or attack in the last 12 months. - **Phishing** was by far the most common attack, hitting 38% of businesses. Among those breached, just over half (51%) saw phishing and nothing else. - Only **47%** of businesses require two-factor authentication. For micro businesses it's 43%, though that's up from 35% the year before. That last figure is the gap. Phishing is how attackers get a password, and two-factor authentication is what stops a stolen password being enough. Fewer than half of businesses have it switched on. The global picture is a bit more complicated. In Verizon's [2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/?ref=adamjrg.com), exploiting software vulnerabilities was the most common first step into a breach, at 31%, ahead of phishing (16%) and credential abuse (13%). Verizon also split pretexting out as its own category this year, which took some of credential abuse's share. But that 13% only counts how attackers first got in. Counted at any stage of a breach, credential abuse turns up in 39% of breaches, more than any other technique. So patching matters more than ever, but identity hasn't stopped mattering. Stolen credentials are often how attackers move around once they're inside. ## The five things I'd do None of these need new software if you're already on Microsoft 365 or Google Workspace. They're in the order I'd tackle them. ### 1\. One identity per person, in one place Every person gets their own account, and that account lives in one directory: your Microsoft 365 (Entra ID) or Google Workspace tenant. No shared logins like office@ or admin@ that five people know the password to. This sounds obvious, but everything else depends on it. You can't put two-factor on a shared password, you can't tell who did what, and you can't remove one person's access without changing it for everyone. ### 2\. Two-factor everywhere, passkeys where you can Turn on multi-factor authentication (MFA) for every account, starting with email and anything in the cloud. If you're on Microsoft 365 without premium licences, [security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?ref=adamjrg.com) do this for free. They make everyone register for MFA, force admins to use it, and block old sign-in protocols that skip MFA entirely. If you can, go a step further with passkeys or security keys. They're phishing resistant, because there's no code for someone to trick out of you. SMS codes are the weakest option, but the NCSC is clear that any MFA beats none. ### 3\. Separate admin accounts, and very few of them Whoever manages your tenant should have two accounts: a normal one for email and browsing, and a separate one used only for admin work. If the everyday account gets phished, the attacker doesn't get the keys to everything. Keep the number of admins as small as you can. In most small companies it's one or two people, plus an emergency "break glass" account stored somewhere safe in case everyone gets locked out. Microsoft [recommends two](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?ref=adamjrg.com#disabling-security-defaults) of those. ### 4\. Joiners, movers and leavers This is where small companies most often slip, because there's no HR system telling IT what changed. Write down three short checklists: - **Joiner:** who approves the new account, and which apps and groups they get. - **Mover:** when someone changes role, remove access they no longer need. Don't just add the new access on top. - **Leaver:** disable the account on their last day, sign them out of every session, and transfer ownership of their files and shared mailboxes. Don't forget accounts that aren't employees. Your IT supplier, your accountant and that contractor from last year probably all have logins. They count too. ### 5\. Single sign-on, and a quick access review Wherever an app supports it, sign in with your Microsoft or Google account instead of a separate username and password. Then MFA protects all of it, and disabling one account cuts off new sign-ins everywhere. It doesn't end sessions that are already open, though, so when someone leaves, revoke their sessions as well. In the Entra admin center that's **Revoke sessions** on the user's page. And check for anything that bypasses SSO: local accounts, API keys and app passwords stay live until you remove them. For apps that don't support SSO, use a business password manager so passwords aren't stored in browsers or spreadsheets. Once a quarter, spend an hour going through who has access to what. A spreadsheet is fine. You're looking for people who've left, admin rights nobody needs any more, and apps nobody uses. In my day job this is called an access review, and at a small company it really is just an hour. ## What it costs Most of the above is free. The one upgrade worth paying for is Conditional Access, and for a Microsoft shop that means Business Premium. | Option | What you get | Rough cost | | ---------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | | [Entra security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?ref=adamjrg.com) | MFA for everyone, MFA for admins, legacy sign-in blocked. On or off, no tuning. | Free with any Microsoft 365 plan | | [Microsoft 365 Business Premium](https://espprojects.co.uk/news/microsoft-365-business-premium-vs-standard/?ref=adamjrg.com) | Entra ID P1 (Conditional Access), Intune device management, Defender for Business. Up to 300 users. | About £18 to £20 per user per month, ex VAT, depending on reseller | | [Entra ID P1 on its own](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing?ref=adamjrg.com) | Conditional Access added to a cheaper plan | US$7 per user per month, paid yearly (Microsoft list price) | Conditional Access is what lets you write rules like "only allow sign-ins from company laptops" or "always ask for MFA from outside the UK". Security defaults can't do that. Microsoft [says](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?ref=adamjrg.com#disabling-security-defaults) organisations with P1 should move from security defaults to Conditional Access, and it offers managed policies that cover the same ground to start with. If you're on Google Workspace or something else entirely, the five steps above still apply. Only the menu names change. ## Cyber Essentials is basically an IAM checklist If you're in the UK, [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview?ref=adamjrg.com) is worth knowing about. One of its five controls, User Access Control, reads almost exactly like the list above. Under the current [v3.3 requirements](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf?ref=adamjrg.com) (April 2026), you need to: - have a process to create and approve accounts - give everyone unique credentials - remove or disable accounts when they're no longer needed - use MFA wherever it's available, and **always** for cloud services - use separate accounts for admin work - remove special privileges when someone no longer needs them, such as after a role change Two details I liked in v3.3\. Cloud services have been in scope for a while, but v3.3 adds a definitive statement that they can't be excluded, so your Microsoft 365 or Google tenant is always included. And it names passkeys and FIDO2 authenticators explicitly, saying FIDO2 authenticators count as MFA. It also covers accounts your suppliers use, which ties back to the leaver point above. Awareness is still low. Only 17% of businesses had heard of Cyber Essentials in the government survey. But the share of small businesses holding it more than doubled in a year, from 5% to 12%. ## My verdict For a small company, identity and access management is a handful of habits, and most of the tools are already in the subscription you pay for. If I had one afternoon at a small company, this is what I'd do: 1. Check that MFA is on for every account. On Microsoft 365, that means switching on security defaults if nothing else is in place. 2. Find every shared login and replace it with named accounts. 3. Give whoever runs IT a separate admin account, and cut the admin list down to the people who really need it. 4. Pull a list of every account and disable anyone who's left, including old suppliers. 5. Write the leaver checklist down, so the next one doesn't depend on someone remembering. After that, Business Premium and Conditional Access are the natural next step, and Cyber Essentials gives you a sensible target to work towards. The basics are the same ones I work with every day: the right people, the right access, at the right time, and nobody else. A small company can get most of the way there in a week. *Prices and licence details change often, so check Microsoft's and the NCSC's current pages before you decide.* ## Sources - [DSIT and Home Office: Cyber Security Breaches Survey 2025/2026 (April 2026)](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026?ref=adamjrg.com) - [NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026)](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf?ref=adamjrg.com) - [NCSC: Cyber Essentials overview](https://www.ncsc.gov.uk/cyberessentials/overview?ref=adamjrg.com) - [Verizon: 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/?ref=adamjrg.com) - [Microsoft Learn: Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults?ref=adamjrg.com) - [Microsoft: Entra plans and pricing](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing?ref=adamjrg.com) - [ESP Projects: Microsoft 365 Business Premium vs Standard (UK pricing, May 2026)](https://espprojects.co.uk/news/microsoft-365-business-premium-vs-standard/?ref=adamjrg.com)