Business account security depends on knowing who can access each system, how that access is protected and when it should end. A firewall or a familiar office location does not answer those questions for email, cloud files and other business applications.
Ask your IT team to walk through these five questions using your actual environment. The goal is a clear account of current access, including the exceptions that need attention.
1. Can we explain who has access?
Start with the systems your people depend on: email, file storage, finance applications, remote access and other important business tools. Ask who maintains the account list and who approves new access.
Include outside providers and former employees in the review. Look at shared access arrangements and whether the business can identify the person responsible for an action. Distinguish a shared mailbox with delegated access from several people signing in with the same credentials.
2. How are important sign-ins protected?
Ask where multifactor authentication is required, which methods are used and what exceptions remain. CISA recommends requiring MFA wherever possible and aiming for phishing-resistant methods. Its guidance distinguishes phishing-resistant approaches from other forms of MFA; number matching is not the same protection as a phishing-resistant method. Read CISA's MFA guidance.
Have your provider explain the options available for your systems and licenses. Check the license, configuration and suitability of each proposed capability against your environment.
3. Who has administrative access?
Administrative access can change the environment. Ask which people need it, why they need it and how it is reviewed.
Name the business owner who approves administrative access and the person who maintains the record. Ask how temporary access for an outside provider is reviewed and removed when its work is complete. Include an authorized recovery arrangement so responsibility does not depend on one person being available.
4. Which connections have automated access?
Identify connections that act without a person signing in each time: integrations, scheduled tasks and connected AI tools. Each should have a known business purpose and an owner who can explain why it still needs access.
When a connection is no longer used, plan its removal with the people responsible for dependent work. An unfamiliar account may require investigation before a change is safe.
5. What happens when somebody changes roles or leaves?
Review the full employee transition, including systems beyond the email account. Ask how HR or management tells IT about a change, which systems are covered and who confirms completion.
Role changes deserve attention as well as departures. A person moving departments may need new access and may no longer need old access. Record exceptions, including information the business needs to retain, and assign an owner to resolve them.
Review the process with Microsoft 365 administration and any other application providers so responsibilities are clear.
For the wider provider relationship, read who owns accounts, documentation and Microsoft 365.
Frequently asked questions
Does MFA make an account completely safe?
No single control provides complete protection. The method, configuration, account permissions and surrounding processes all matter.
Should everyone have only one account?
People may need separate accounts for different purposes, such as routine work and administration. What matters is that each account has a clear owner, purpose and appropriate access.
Are advanced identity tools included in managed IT?
ProIncident includes Microsoft 365 administration for a standard business environment. Advanced requirements may need additional scope; licensing and configuration should be discussed explicitly.
Make access an ongoing responsibility
If account access depends on scattered instructions or one person’s memory, start there. Discuss how administration and business approval should work together.