| Identity and access management (IAM) is how your business controls which people and applications can use its systems, what they can do, and when access should end. It combines sign-in protection with permissions, account ownership and a clear process for staff changes. |
For a small business, start with the systems people use and who approves access to each one. This identity and access management guide explains how to manage permissions, protect administrator accounts and handle people joining, moving roles or leaving.
It is written for New Zealand business owners and managers rather than IT specialists. It covers what identity and access management includes, how to map accounts and owners, how to protect sign-ins, what to do when staff change, how to review access, what Microsoft 365 includes and where IAM fits alongside your other protection.
What does identity and access management cover?
Identity and access management covers four practical areas. Together they decide who can sign in, what each account can reach and when that access changes.
The four areas in the graphic are a practical grouping rather than separate products:
- Identity governance. Creating, changing and removing accounts as people join, move and leave, with an owner for each account.
- Access control. Deciding what each role or account can reach, using roles or groups so access is applied consistently.
- Multi-factor authentication. Confirming a sign-in with more than one type of proof.
- Privileged access. Extra protection for administrator accounts that can change settings, create users or reach sensitive data.
A stolen login can give an attacker access to the systems and information that account is allowed to use. Identity controls reduce that risk by protecting sign-ins, limiting permissions and removing access when it is no longer needed. Device checks, network security, monitoring and recovery provide other layers of protection. A valid password does not guarantee entry when additional controls apply.
How do you map accounts and system owners?
Identity and access management starts with knowing which systems the business uses, which accounts exist in each one and who is responsible for approving access. Without that map, it is hard to tell whether an account is still needed.
List systems and owners
Identity and access management depends on that list. List the systems people sign in to: email and Microsoft 365, finance and payroll, line-of-business applications, file storage, websites and supplier portals. For each, record a business owner who approves access, the person or provider who makes changes, and whether sign-in goes through your main work account or a separate login.
Give every account an owner and a purpose
In identity and access management, not every account belongs to an employee. Integrations, applications and service accounts are legitimate identities too, as are suppliers and guests who need temporary access.
- Staff accounts. One named account per person, so access can be changed for one person without affecting others.
- Service and integration accounts. A named business owner, only the permissions the integration needs, and credential controls suited to an unattended account. Do not apply a staff MFA prompt to an integration that has no person to answer it.
- Suppliers and guests. An expiry or review date, and access limited to what the work requires.
- Shared accounts. Replace them with individual accounts where the system allows. Where a shared credential is unavoidable, store it in a business password manager and record who can use it.
Where to start
Identity and access management does not need to cover every system at once. Start with the systems that hold money, personal information and administrator access, such as Microsoft 365, finance, payroll and your domain and website accounts. Confirm who owns each one, remove accounts nobody can explain, and make sure every remaining account has a named owner. Then extend the same approach to the other systems on your list.
How do you protect sign-ins and administrator accounts?
Protecting sign-ins is the part of identity and access management that stops a stolen password from being enough on its own. Protecting administrator accounts limits what an attacker could change if one of those accounts were compromised.
Use strong sign-in methods
Multi-factor authentication uses more than one type of proof to confirm a sign-in. It is one part of identity and access management, which also covers accounts, permissions and access changes. The method matters: passkeys and security keys resist fake login pages, while codes and approval prompts can still be targeted. Use the strongest supported method and prepare a recovery route before rollout.
The US Cybersecurity and Infrastructure Security Agency’s fact sheet on phishing-resistant MFA explains why some methods resist phishing better than others. Our guides to multi-factor authentication and passkeys compare the methods in more detail. A stolen signed-in session is a separate risk from a stolen password, so session protection matters as well.
Check the conditions of each sign-in
Conditional Access policies in Microsoft Entra ID can take account of the user, the device, the location and the application before allowing a sign-in. Microsoft’s Conditional Access overview describes how these signals combine. Device checks depend on devices being managed and configured, for example through Microsoft Intune. Conditional Access is one of the identity and access management controls that depends on licensing, covered in the Microsoft 365 section below.
Separate and limit administrator access
- Separate admin accounts. Use a separate administrator account for admin tasks, rather than everyday email and browsing.
- Few administrators. Keep administrator rights to a small, named group, and limit each to the roles they need.
- Strongest sign-in method. Protect admin accounts with phishing-resistant methods where supported.
- Emergency access. Keep a tested emergency access account so a sign-in problem does not lock the business out.
Administrator accounts deserve the strongest identity and access management controls, because they can change settings and permissions for everyone else.
Privileged access management is a practice. Time-limited elevation and activity recording depend on the tools and licences you have, so check what is available before planning around them.
How should identity and access management handle staff changes?
Staff changes are where identity and access management does its practical work. Each change needs a business decision and an operational action.
| Event | Business decision | Operational action |
|---|---|---|
| Someone joins | Approve systems, role and any expiry. | Create named access, apply permissions, configure authentication and recovery. |
| Someone changes role | Approve new access and identify what ends. | Add required access; remove previous roles, groups and direct permissions. |
| Someone leaves | Agree access cutoff and ownership of records. | Block sign-in, revoke sessions where supported, remove app access and handle shared secrets. |
| Access is reviewed | Confirm owner, purpose and continued need. | Update permissions, resolve exceptions and record completion. |
When someone moves role
Define the access each role needs, then use roles or groups to apply it consistently. When someone moves, remove access from the old role as well as adding the new one. Some systems can automate parts of this process once integrations are configured. Others need a manual change, so keep a list of the systems covered and who updates each one.
Single sign-on centralises how people sign in to connected applications. It does not by itself create, disable or delete accounts in those applications. Microsoft’s guidance on automatic user provisioning explains that creating and removing application accounts depends on supported, configured provisioning for each application.
When someone leaves
Block access at the agreed departure time, but retain or transfer business records before deleting accounts or removing licences. Disabling the main work account is one step. Check each business application, revoke active sessions where supported, remove permissions and review any shared credentials.
Microsoft’s guidance on revoking user access explains that Entra ID cannot directly revoke a session issued by another application, so existing application sessions can need separate action. Change any shared passwords the person knew, because removing them from a password vault does not change those passwords. Blocking an account cannot retract information already downloaded. For help making these changes, our Active Directory management service covers Active Directory and Microsoft Entra ID.
What is the principle of least privilege?
Least privilege means giving each person, account and integration only the access needed for its job. If the reception team does not need payroll, they do not get payroll access.
Least privilege reduces the access exposed by one account. It does not guarantee containment: attackers may exploit other weaknesses or obtain further permissions. It is one of the identity and access management principles behind a zero trust security approach, where access is checked rather than assumed.
Apply it by starting with what each role needs, removing permissions that are not in use, and granting new access against defined roles rather than individual requests. Watch for access creep, where people collect permissions as they move between roles and projects and the old access is not removed.
When should you review access?
Quarterly reviews can be a starting point for identity and access management, with prompt action on staff and role changes. Administrator and privileged accounts deserve closer attention because they can change more.
A review confirms the owner, purpose and continued need for each account and permission, not simply that an account matches a person. Check rare use before removing permissions: emergency access, seasonal work and business dependencies may still be legitimate. Pilot changes and test recovery to avoid locking the business out. Access reviews can be performed manually, and automated review features have their own licensing requirements. For SharePoint, OneDrive, Teams and mailbox access, a Microsoft 365 permissions audit checks who can reach each resource against what its owner intends.
What identity and access management features does Microsoft 365 include?
Microsoft 365 includes identity controls, but the options depend on your plan and configuration. Security defaults provide a baseline; more tailored Conditional Access policies need appropriate licensing. Check which settings are active, which users they cover and which other business apps need separate management. Our Microsoft 365 guide explains the plan differences.
| Control | What to know |
|---|---|
| Security defaults | An included baseline in Entra ID. Check whether enabled and suitable for the tenant. |
| Custom Conditional Access | Requires Entra ID P1 or higher. P1 is included in Microsoft 365 Business Premium; Basic and Standard need additional qualifying licensing. |
| Risk-based Conditional Access | Policies using user or sign-in risk require Entra ID P2. |
| Privileged Identity Management | Requires Entra ID P2 or Entra ID Governance licensing. Business Premium P1 alone does not include it. |
| Access reviews as a practice | Can be performed manually. Automated governance features have their own licensing requirements. |
Microsoft’s page on security defaults explains that they are available at no extra cost and may already be enabled on newer tenants, and that organisations using custom Conditional Access policies must turn security defaults off. Its governance licensing page sets out which users need licences for Privileged Identity Management and access reviews. Licence coverage must match the users and features in scope.
Establish what is already active before deciding what to enable. Some businesses already have security defaults switched on, and others have Conditional Access policies in place that need reviewing rather than replacing.
How does identity and access management support privacy obligations?
Identity and access management can support NZ Privacy Act safeguards by limiting access to personal information and keeping permissions current. Useful logs can also help investigate an incident. The safeguards needed depend on the information and circumstances; IAM alone does not establish compliance or guarantee a complete record of activity.
The Privacy Commissioner’s guidance on Information Privacy Principle 5 requires security safeguards that are reasonable in the circumstances. If a privacy breach has caused or is likely to cause serious harm, the Privacy Commissioner’s breach notification guidance explains what needs to be reported. Our guide to the NZ Privacy Act and cyber security covers the obligations in more detail.
In identity and access management, sign-in logs record authentication events, not every file a person opened, and they cannot prove who was behind a stolen account. What is recorded depends on configuration, retention and licensing. Cyber insurance requirements and outcomes depend on the policy terms.
How does identity and access management fit with other protection?
Identity controls are one layer. Network security controls what can connect, endpoint security protects devices, and monitoring and recovery limit the impact when something gets through. Each has its own role, and none replaces the others.
Identity and access management is valuable because business data held in cloud services is reached through a sign-in. That makes it a sensible early priority, alongside the other layers rather than above them. An IT assessment can show where your current gaps are.
Should you manage identity controls in-house or use a provider?
Either can work. What matters is a clear split of responsibilities: who approves access, who makes changes in each system, who reviews permissions and who acts on alerts. Your business keeps the decisions about who should have access, even when a provider makes the technical changes. Identity work is ongoing, because people join, move and leave throughout the year.
Identity and access management support from Exodesk
Exodesk provides identity and access management for cloud accounts, permissions and staff access changes through our cloud security service, which covers Microsoft 365 and the Exodesk hosted platform, with other cloud services assessed individually. We agree responsibilities and scope before work starts.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
NEXT STEP
Need help managing cloud accounts and access?
Our cloud security service explains the systems we cover and how responsibilities are agreed before work starts. Talk to Exodesk about the access controls your business needs.
Or see our cloud security service.
Frequently Asked Questions
What is identity and access management in simple terms?
Identity and access management is how a business controls which people and applications can use its systems, what they can do and when access ends. It combines sign-in protection with permissions, account ownership and a process for staff changes.
Why is identity and access management important?
A stolen login can give an attacker whatever that account can reach. Identity and access management reduces that risk by protecting sign-ins, limiting permissions and removing access that is no longer needed. Device checks, network security, monitoring and recovery provide other layers.
What is the difference between identity and access management and MFA?
Multi-factor authentication uses more than one type of proof to confirm a sign-in. It is one part of identity and access management, which also covers accounts, permissions and access changes. Passkeys and security keys resist fake login pages better than codes or approval prompts.
What is the principle of least privilege?
Least privilege means giving each person, account or integration only the access its job needs. It reduces the access exposed if one account is compromised. It does not guarantee containment, because attackers may exploit other weaknesses.
Does role-based access update permissions automatically?
Roles group permissions by job, but old access is not removed automatically when someone moves. Remove the previous role, groups and direct permissions as well as adding the new ones. Some systems can automate parts of this once integrations are configured.
Does single sign-on remove access when someone leaves?
Single sign-on centralises how people sign in to connected applications. It does not by itself disable or delete their accounts in those applications. That depends on configured provisioning or a manual change in each system.
Does disabling the work account remove access everywhere?
Not necessarily. Existing sessions in other applications can need separate action, and some systems have their own logins. Revoke sessions where supported, remove application access, change shared passwords the person knew and keep business records before deleting accounts.
How regularly should access be reviewed?
Quarterly reviews are a reasonable starting point, with prompt action whenever someone joins, changes role or leaves. Each review should confirm the owner, purpose and continued need for each account and permission.
Do service accounts need MFA?
Service and integration accounts need a named owner, limited permissions and credential controls suited to an unattended account. A staff MFA prompt does not suit an integration with no person to respond. Review these accounts alongside staff accounts.
Are Microsoft 365 identity controls enough on their own?
Microsoft 365 includes identity controls, but the options depend on your plan and configuration. Security defaults provide a baseline, while custom Conditional Access needs Entra ID P1 and risk-based policies need P2. Check which settings are active and which other applications need separate management.
How does identity and access management help with the NZ Privacy Act?
It can support Privacy Act safeguards by limiting access to personal information and keeping permissions current. Useful logs can help investigate an incident. It does not by itself establish compliance or provide a complete record of activity.
Should we manage identity controls ourselves or use a provider?
Either can work if responsibilities are clear. Agree who approves access, who makes changes in each system, who reviews permissions and who acts on alerts. The business keeps the decisions about who should have access.
Contact us or call 0800 396 337 to talk through the access controls your business needs.
