Identity and Access Management for Small Business: Who Can Reach What?

Most small businesses can tell you exactly who has a key to the front door. Far fewer can tell you who still has a login to the accounting system, the CRM, the domain registrar, or the company social accounts. That gap — the difference between the people you think have access and the people who actually do — is where a surprising number of security incidents, billing surprises, and “we can’t get into that account anymore” emergencies come from.

Identity and access management is the discipline of answering three questions on purpose instead of by accident: who is this person, what should they be able to reach, and how do we take it away when they leave. It sounds like enterprise vocabulary, and the software vendors have done their best to make it sound expensive. It isn’t. For a 10- to 100-person company, good identity and access management is mostly a handful of decisions, a couple of tools, and a habit of writing things down. We’ve walked a lot of Orange County businesses through this, and the ones who get it right are rarely the ones with the biggest budgets — they’re the ones who treated access as something to be designed rather than something that accumulates.

What Identity and Access Management Actually Means

Strip away the acronyms and IAM covers four moving parts:

• Identity — the authoritative record of who works here. Ideally one directory, not a spreadsheet plus somebody’s memory.
• Authentication — proving the person is who they claim to be. Passwords, passkeys, multi-factor prompts.
• Authorization — what that verified person is permitted to do once they’re in. Admin versus viewer, this client folder but not that one.
• Lifecycle — granting access on day one, adjusting it when roles change, and revoking it the hour someone leaves.

Small businesses usually do the first two reasonably well and neglect the last two entirely. Authorization drifts upward because it’s faster to make someone an admin than to figure out the right permission level. Lifecycle breaks because offboarding is emotional and rushed, and nobody wants to be the person asking about logins on somebody’s last day.

Access is easy to grant and awkward to remove. Left alone, every organization drifts toward everyone having everything — which is exactly the condition attackers count on.

Why This Matters More Than It Used To

Ten years ago, a small business kept its important systems on a server in a closet, and controlling access largely meant controlling the building. Today the average small company runs on twenty or more cloud services, each with its own login, its own permission model, and its own idea of what “admin” means. Your critical data isn’t behind one door anymore. It’s behind twenty, and most of them open from any coffee shop on earth.

That shift changes the threat model in a specific way: the credential is the perimeter. An attacker doesn’t need to breach a firewall if they can log in as your office manager. And credentials leak constantly — through reused passwords, phishing emails that look exactly like a Microsoft prompt, and breaches at unrelated companies where your team used the same password.

The other half is quieter but just as expensive. When access isn’t managed, ordinary business gets harder. Nobody knows who owns the domain renewal. The person who set up the payment processor left two years ago and the recovery email is their old address. We’ve seen companies spend weeks and real legal expense recovering control of accounts they own outright — a problem that costs nothing to prevent and a great deal to fix. Our broader guide to small business cybersecurity covers the surrounding defenses; access control is the foundation the rest of it sits on.

Start With an Access Inventory

You cannot manage what you haven’t listed. Before buying any tool, build a simple inventory. A spreadsheet is fine. For every system the business depends on, capture:

1. The system — name and URL.
2. The business owner — the human accountable for it, not the vendor.
3. Who has access today — every account, including ones shared with contractors and agencies.
4. Permission level — admin, standard user, read-only.
5. Criticality — what happens to the business if this is lost or compromised.
6. Who pays for it — surprisingly often, the answer reveals an account nobody’s watching.

Two things reliably fall out of this exercise. First, a list of active accounts belonging to people who no longer work with you. Second, a much longer list of admins than anyone expected. Both are fixable in an afternoon, and fixing them is the single highest-return security work most small businesses can do.

Pay Special Attention to the Crown Jewels

A few accounts are categorically more dangerous than the rest, because control of them means control of everything downstream. Treat these differently:

• Domain registrar and DNS — whoever holds this can redirect your website and intercept your email.
• Email tenant administration — Microsoft 365 or Google Workspace global admin.
• Banking and payment processing.
• The password manager itself, and any recovery mailbox or phone number.
• Website hosting and CMS admin.

For each of these, the business — not an individual employee, and not an outside vendor — should hold ultimate ownership, with recovery contacts pointing at addresses the company controls permanently.

The Four Controls Worth Implementing First

1. A Password Manager, Company-Wide

This is the unglamorous foundation. A business-tier password manager gives every employee a private vault, gives the company shared vaults for team credentials, and gives you the ability to revoke everything at once when someone departs. Critically, it also ends the practice of credentials living in email threads, sticky notes, and a shared document called passwords_final_v2.

Roll it out with a real onboarding session, not an email announcement. Adoption is the entire game — a password manager that half the team ignores has made your inventory worse, not better, because you now have two systems of record.

2. Multi-Factor Authentication Everywhere It’s Offered

MFA is the highest-leverage control in this entire article. A stolen password alone stops being sufficient. Turn it on for email first, then finance, then everything else.

Not all second factors are equal. Ranked from strongest to weakest:

Method	Strength	Notes
Passkeys / hardware security keys	Strongest	Resistant to phishing; the credential can’t be typed into a fake site
Authenticator app with number matching	Strong	Good default for most small businesses
Standard authenticator app codes	Good	Solid, though a convincing phishing page can relay a code
SMS text codes	Weak	Vulnerable to SIM-swap attacks; still far better than nothing

Push-approval fatigue is a real failure mode — people tap “approve” reflexively. Choosing methods that require a number match or a physical key removes that reflex from the equation.

3. Least Privilege, Applied With Judgment

Least privilege means giving each person the access their job requires and nothing more. In practice, the useful version for a small business isn’t a rigid permission matrix — it’s a short set of role templates. Define what “sales rep,” “bookkeeper,” and “operations manager” get access to, and provision from the template instead of improvising each time.

Then apply the rule that matters most: limit the number of administrators. Most systems need two admins — one primary, one backup — and no more. Everyone else can be a standard user. If someone occasionally needs elevated access for a specific task, grant it for that task and remove it afterward.

4. Single Sign-On, Once You’ve Outgrown the Basics

Single sign-on lets employees log into multiple business applications with one managed identity, typically their Microsoft 365 or Google Workspace account. The security benefit is significant: disable the one directory account and access to every connected app disappears simultaneously. No hunting through twenty admin panels.

SSO carries real costs, though. Many vendors charge a premium for it, and setup takes technical work per application. Our general guidance is to connect SSO for your highest-risk and most widely used systems first, and leave the long tail on the password manager. Perfect coverage is rarely worth what vendors charge for it.

Getting the Lifecycle Right

Controls decay without process. Three routines keep identity and access management from drifting back into chaos:

Onboarding from a template. New hires get a defined bundle based on their role, provisioned before day one. This is faster for you and better for them — nothing sours a first week like spending it waiting on logins. We’ve written a full IT onboarding and offboarding checklist that pairs directly with this.

Same-day offboarding. When someone leaves, access should end within hours, not weeks. The steps: disable the directory account, revoke active sessions and tokens, transfer file ownership, forward or delegate the mailbox, remove them from shared vaults, rotate any shared credentials they knew, and collect hardware. Write it once as a checklist so it’s executable by whoever is available on a difficult day.

A quarterly access review. Once a quarter, the owner of each critical system confirms the current access list is still correct. Fifteen minutes per system, four times a year. This one habit catches nearly everything the other controls miss — the contractor whose project ended, the promoted employee still holding their old permissions, the vendor account that was supposed to be temporary.

Every access decision should have an expiration date attached, even if that date is “when this project ends.” Permanent by default is how sprawl begins.

Don’t Forget Non-Human and Third-Party Access

Two categories consistently escape the inventory. The first is service accounts and API keys — the integrations connecting your CRM to your email platform, your booking tool to your calendar, your website to your payment processor. These have credentials, they rarely have MFA, and nobody remembers who created them. Inventory them alongside human accounts and rotate their keys on a schedule.

The second is vendors, agencies, and contractors. Outside partners should get access through their own named accounts, at the minimum permission level, with an end date. Never share the owner’s login with a vendor. When the engagement ends, revoke access as deliberately as you would for an employee.

A Realistic 30-Day Plan

1. Week 1 — Build the access inventory. Identify the crown-jewel accounts and confirm the business controls their recovery contacts.
2. Week 2 — Enable MFA on email, banking, the domain registrar, and hosting. Remove accounts belonging to departed people.
3. Week 3 — Roll out the password manager with a live training session. Move shared credentials into shared vaults and delete them from email and documents.
4. Week 4 — Cut the admin list down to two per system. Write the onboarding and offboarding checklists. Put a recurring quarterly access review on the calendar with a named owner.

That’s a month of modest effort that eliminates the majority of realistic credential-based risk for a typical small business. SSO, conditional access policies, and device management are worthwhile next steps — but they’re refinements on top of this foundation, not substitutes for it.

Where This Fits in the Bigger Picture

Access control isn’t a project you finish. It’s a property of a well-run business, maintained the same way you maintain your books — small, regular attention that prevents large, irregular emergencies. The companies that handle it well aren’t more paranoid than everyone else. They’ve just decided that knowing who can reach what is a normal part of operating, rather than something to sort out after an incident.

If your access inventory is currently living in someone’s head, that’s the honest place to start. Write it down first. The tools are the easy part.

Frozen Crow helps Orange County businesses design and run the systems behind the business — from I.T. services and communications to cloud infrastructure, integrations, and the security practices that hold it all together. If you’d like a second set of eyes on who has access to what, we offer a free, no-obligation consultation. Reach out at frozencrow.com and we’ll help you build an access model that fits how your team actually works.