Identity & Access Management in Action

How does identity and access management protect a business?

Identity and access management (IAM) controls who can sign in to your systems and what they can reach once they're in. The core tool is multi-factor authentication (MFA): a second proof, like a phone prompt, required on top of a password. When a password gets stolen, MFA is the second lock the attacker still has to pick.

I've spent 30 years in IT, and I'd rather show you than tell you. Here are two real incidents from clients of ours, and how we set this up. I've left out names and details, because these stories belong to the clients.

What happened when a stolen password met MFA?

A client's team flagged a run of risky sign-in attempts on one employee's account. The password looked compromised.

The attacker had the password. They didn't have the second step, so the sign-in never completed.

We confirmed what was going on, got the password reset, and checked with the employee that the change was done. Then we closed the loop with the client's team.

The password alone wasn't enough. That's the whole point of MFA.

It isn't a one-off. Microsoft's 2025 Digital Defense Report found that more than 97% of identity attacks are password attacks, and Microsoft says MFA can block over 99% of identity-based attacks. That's Microsoft reporting on its own platform, so weigh it that way. CISA, the U.S. government's cyber agency, tells small businesses to require MFA wherever possible, starting with email, file storage, remote access, and administrator accounts.

What happens when one account seems to be in two places at once?

Our security monitoring flagged a sign-in that didn't add up: one account, apparently used from places too far apart for one person to travel between. The industry calls it an "impossible travel" alert.

The employee told us they'd clicked a link in a phishing email just beforehand. They also used the same password on several accounts. Here's what we did:

• Reset the password on every affected account.
• Checked that no unfamiliar sign-in methods had been added. An attacker with access can register their own phone, and that would keep the door open after a password change.
• Cleared the browser data on the employee's device.

One password across several accounts turns one phishing click into several problems.

How do we set up MFA for a business?

When a client asks us to require MFA by default, this is the order we follow:

• Inventory.

  We build a report of every user: whether MFA is on, and which conditional access policies apply. (A conditional access policy is a rule that decides when someone must prove who they are.) We leave out guests and outside domains, so the list shows your real team.
• Pick test users.

  You choose a few people to try it first.
• Test.

  We add those users to the MFA policy and confirm the prompts appear, including when signing in to admin portals.
• Decide the message.

  You tell us whether we email the company or you handle it.
• Roll out to everyone.

  The last step is rolling it out to everyone, so new accounts are covered from day one.

We also check who a rule actually covers. At one client, the group that required MFA held employees only, so contractors weren't covered. We built a separate group for them and tested it.

What should you ask your own IT provider?

Does MFA cover everyone who can sign in, including contractors and guests? Who checks that list, and how often? If nobody can answer, you've found the gap, and it's fixable. Trust, yet verify.

Always on watch, Tom

FAQ

What is multi-factor authentication?

A second proof of identity, such as a phone prompt, required on top of your password.

Does MFA stop every attack?

No. In the first incident above, it stopped the sign-in. In the second, the response was a password reset plus checking for added sign-in methods. MFA is one layer, and we run it alongside monitoring. Even Microsoft's own figures describe blocking most attacks, not all of them.

Is all MFA the same?

No. CISA ranks security keys first, then authenticator apps with number matching, and puts text and email codes last, for when nothing stronger is available.

What is a conditional access policy?

A rule that decides when your systems ask for extra proof, such as when someone signs in from a new device or place.

Do contractors and guests need MFA too?

If they can sign in to your systems, they're a way in. The question to ask is who your rule actually covers.