Many London small and medium-sized businesses have already enabled multi-factor authentication (MFA) on their email and cloud accounts. That step matters, but it does not close the gap. Effective identity protection for a London SME also depends on who holds elevated access, how each sign-in is evaluated, and how suspicious activity is detected and contained. This article sets out the controls that extend MFA in Microsoft 365 and Microsoft Entra ID environments.
Table of Contents
- Quick Takeaways
- Why Multi-Factor Authentication Alone Falls Short
- Privileged Accounts Need Separate Controls
- Entra ID Security Settings Worth Reviewing
- Monitoring Sign-Ins and Responding to Identity Threats
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| MFA is a necessary layer, not a complete one | MFA verifies a sign-in but does not limit what an authenticated user can reach. |
| Separate administrator accounts from daily accounts | Standing administrator rights are the most valuable target in most SME tenants. |
| Confirm licence entitlements before enabling features | Feature availability depends on the Microsoft Entra plan, so check the licensing guide first. |
| Remove privileged roles that are no longer needed | Quarterly role reviews usually find former staff, contractors, or projects still holding access. |
| Restrict user consent for third-party applications | A user approving a malicious application can grant it mailbox or file access without an attacker ever entering a password. |
| Define a response window for risky sign-ins | Alerts without a named owner and a response procedure delay containment. |
Why Multi-Factor Authentication Alone Falls Short
MFA adds a second verification step to a password, such as an app prompt or a one-time code. Vendor documentation describes this as an extra verification layer, while passwordless sign-in removes the password step entirely. Both approaches reduce the risk of a stolen password being sufficient on its own.
In practice, the weak point is often what happens after sign-in. A user who passes MFA can still forward mail, export files, or approve an application that requests broad permissions. MFA confirms who is at the door. It does not determine which rooms that person can enter once inside.
For most London SMEs, the risk concentrates in a small number of accounts. Finance, directors, and administrators typically hold the highest levels of access, so these accounts warrant controls beyond a standard MFA prompt.
Privileged Accounts Need Separate Controls
Privileged accounts hold permission to change security settings, reset passwords, or assign roles. When an attacker compromises one, the impact extends across the whole tenant. Reducing the number of standing privileged assignments is therefore the most effective change many SMEs can make.
Standing and eligible administrator access
Microsoft Entra Privileged Identity Management supports eligible role assignments, where an administrator activates a role only when needed. Activation can require approval, a business justification, and a time limit. Confirm which plan includes this capability in Microsoft’s licensing guide before planning the change.
Break-glass accounts
Every tenant should hold at least two emergency administrator accounts excluded from routine policies. These accounts should use strong, non-reusable credentials stored securely, and sign-in attempts should trigger alerts. Testing them periodically confirms that access works when it is needed.
Pro tip: Create a named administrator account for each person who needs elevated rights, and do not use day-to-day mailboxes for administration. This separation makes sign-in logs easier to read and limits the damage from a phished daily account.
Entra ID Security Settings Worth Reviewing
Conditional Access policies evaluate each sign-in against conditions such as user group, device compliance, location, and sign-in risk. They then allow, block, or require stronger verification. Policies of this kind are usually more effective than a blanket MFA requirement because they target the sign-ins that carry the most risk.
The table below compares common authentication approaches that SMEs encounter when they review their options.
| Approach | Strength | Limitation |
|---|---|---|
| Password with SMS one-time code | Better than a password alone and simple for staff to use. | Codes can be intercepted or redirected through SIM-related attacks, and phishing sites can relay them in real time. |
| Authenticator app with number matching | Requires the user to enter a number shown on the sign-in screen, which reduces accidental approvals of push prompts. | Depends on users recognising unexpected prompts, so training still matters. |
| Passwordless sign-in with an enrolled device | Removes the reusable password, which is the target of most credential theft. | Requires device enrolment and a documented recovery process for lost devices. |
Restricting user consent to applications
Third-party applications can request access to mail, files, and calendars on behalf of users. Restricting consent so that only administrators can approve applications, or limiting consent to verified publishers, prevents a common route into Microsoft 365 data. Review existing app registrations and remove any that no longer serve a purpose.
Monitoring Sign-Ins and Responding to Identity Threats
Preventive controls reduce exposure, but monitoring establishes whether an attack has occurred. Sign-in logs and risk detections in Microsoft Entra ID show unfamiliar locations, impossible travel, and repeated failed attempts. Reviewing these signals on a defined schedule is more reliable than relying on users to report problems.
Defining an identity incident procedure
A written procedure should name who receives alerts, who can disable an account or revoke sessions, and how staff are informed. Without these decisions made in advance, containment depends on whoever notices the alert first. The procedure should also cover how to confirm whether mail rules or application grants were altered.
Identity controls are only as useful as the response that follows an alert.
iTO.London operates as an outsourced IT department for London SMEs, and identity controls form part of that managed service. Privileged access reviews, Conditional Access configuration, and sign-in monitoring can be handled within a single support agreement, while directors retain oversight through regular reporting. Businesses that prefer to manage these controls internally can use the steps above as a practical starting point. Further details on the service are available at iTO.London.
Frequently Asked Questions
Is MFA enough to protect a Microsoft 365 tenant?
MFA is a necessary control, but it does not limit what an authenticated user can access. Privileged access management, Conditional Access, and monitoring are needed to address that gap.
What is Privileged Identity Management in Microsoft Entra?
It is a Microsoft Entra capability that allows administrators to hold eligible roles and activate them on demand, with approval and time limits. This reduces the number of permanently privileged accounts.
Do all SMEs need the highest Entra ID licence tier?
Not necessarily. The right tier depends on which features a business requires, such as privileged access management or advanced risk detection. Compare requirements against Microsoft’s licensing guide before purchasing.
How often should privileged access be reviewed?
A quarterly review is a practical baseline for most SMEs. Reviews should remove roles that are no longer needed and confirm that each remaining assignment has a documented reason.
What should a business do if a staff member account is compromised?
Disable the account, revoke active sessions, and review recent sign-in activity, mail rules, and application permissions. Then reset credentials, notify affected staff, and record the incident for future reference.
We welcome feedback from business owners and office managers on which identity controls have proved most difficult to implement in their organisations.
We would love your feedback and any insights you would share with others. What perspective would you add?