Your business logins control access to more than email. They can open your customer records, payroll, banking, website, backups, and the software your employees use every day.
You need to protect those accounts and make sure your business can regain access when an employee leaves, a phone is lost, or something suspicious happens. A strong password is a useful starting point, but account security also depends on permissions, authentication, recovery, and ongoing review.
1. Know which accounts your business depends on
Start with a list of important services and the person responsible for each. Include Microsoft 365, banking, payroll, accounting, business applications, domain registration, website hosting, social media, and vendor portals.
Record who owns the account, who has administrator access, and how recovery works. Keep actual credentials in an approved password manager or secure credential system, not in the inventory spreadsheet.
Pay particular attention to services originally set up by a former employee or outside vendor. Your company should have a documented way to control its own accounts without depending on that person’s personal email address or phone.
2. Require MFA and check that it covers everyone
Multi-factor authentication, or MFA, adds another way to verify a sign-in beyond a password. Enable and enforce it on business services that support it, especially email, financial systems, remote access, and administrator accounts.
Ask your IT provider to check actual coverage. Making MFA available is different from requiring it. Old accounts, exceptions, and unsupported sign-in methods deserve review rather than an assumption that everyone is protected.
CISA recommends phishing-resistant MFA. Where supported, methods such as FIDO2 security keys and compatible passkeys can resist fake login websites that trick users into handing over passwords and authentication codes. Your provider should assess compatibility and plan the rollout.
Until you can adopt stronger methods, do not leave accounts without MFA. Teach employees to reject and report unexpected approval requests and never give a login code to a caller.
3. Use unique passwords and stop passing them around
Use a different, long password for each account. Reusing a password means a problem at one service can put other accounts at risk. A business password manager can help employees generate and store unique passwords without trying to memorize them all.
CISA’s password guidance supports strong, unique passwords and password managers. Choose an approved tool and decide how access will be granted, removed, and recovered.
Give employees individual accounts wherever possible. For an application that genuinely requires a shared credential, limit access through your approved system and document how you will change it when someone leaves. Emailing the password to the whole office makes that much harder.
4. Limit administrator access
Administrator accounts can change settings and permissions that affect other users. Give those rights only to people who need them, and use separate accounts for administration and ordinary daily work where the system supports that arrangement.
Review vendor and contractor access too. Someone who needed temporary access for an installation should not automatically retain it indefinitely.
Your account review should include applications connected to your environment. An employee approving a third-party application may grant access to business information without sharing a password.
5. Make account changes part of hiring and offboarding
When you hire someone, assign access based on their job. Your small business IT policies should name who approves that access; revisit it when their responsibilities change instead of allowing permissions to accumulate.
When someone leaves, coordinate the timing with your IT provider. Address sign-in access, active sessions, shared credentials, recovery contacts, and accounts outside Microsoft 365. Decide how business records will be retained or transferred before deleting anything.
For example, disabling an employee’s email account does not necessarily remove their separate access to your payroll portal or website. Your account inventory should make those other services visible.
6. Plan recovery before you need it
Know what happens if the person holding an authentication device is unavailable. Keep approved recovery options current and protect recovery codes as carefully as other credentials.
Your IT provider should also maintain a secure emergency-access arrangement for critical administration. Microsoft provides guidance for emergency access accounts that includes protection, monitoring, and testing. An account left unprotected “just in case” creates another risk.
Document who can authorize a reset. A convincing phone call or an email displaying an executive’s name should not be enough to reset a sensitive account.
7. Decide who reviews suspicious activity
Your provider should explain which account alerts and logs are available, what is being monitored, and who investigates concerns. Capabilities differ by service, configuration, and licensing.
Tell employees to report unexpected MFA requests, unfamiliar account changes, missing messages, or reports that their account sent something they did not send. These are reasons to investigate, even if the employee can still log in normally.
Include account security in your Security Awareness Training. Staff need to understand how to report a concern promptly, including when they already clicked a link or approved a request.
8. Respond to the whole compromise
If you suspect an account has been taken over, contact your IT provider promptly using a trusted contact route. Preserve the suspicious message or alert and explain what happened.
Changing the password may be one response step, but your provider also needs to investigate access and changes the attacker made. For Microsoft 365, Microsoft’s response guidance includes blocking access, revoking sessions, reviewing authentication methods and application permissions, and checking forwarding and inbox rules.
The investigation should also assess what information was accessed and whether other people or accounts were affected. Restoring your ability to sign in does not answer all of those questions.
Keep your account security under review
Your accounts change as you add employees, software, and vendors. Review them periodically and after significant changes, with a named person responsible for following up on gaps.
At Unified Technology Solutions, Microsoft 365 management and cybersecurity protections support our ongoing managed IT services relationships. We can help you review account security and coordinate access changes for the systems we manage, while identifying other accounts your business needs to oversee.
If you want to understand where your business logins need stronger protection, contact UTS to discuss account protection and managed IT needs for your business in Vero Beach or elsewhere on the Treasure Coast.