Defend
Admin access
Admin accounts can open everything, so they are the accounts attackers want most. Admin rights go to few people, by name; the passwords sit in a vault; every use is logged. Ours included.
Whoever holds the keys can open everything.
An admin account doesn’t open one client file. It opens all of them, resets every password, reads every mailbox and switches the protection off. So an insurer, a client or an auditor doesn’t ask whether you have admin accounts, but who holds them, how they are kept and whether anyone would notice their use. Our answer is the same at every firm: admin rights only for the people who need them, each by name; the passwords in a vault, not in a spreadsheet; every use logged; the admin account never used for everyday work. As your IT provider we hold the most powerful accounts in your firm, so this applies to our own keys first. And the keys stay yours.
What we set up
Few, by name, in the vault, logged.
Admin access is set up in Microsoft Entra ID and on every server, the same way, so there is no admin account nobody remembers and no password nobody can revoke.
-
Admin rights for few, by name
Admin roles in Entra ID go only to the people who need them, each by name. No shared admin account, no admin rights “just for now” that stay for good. The list is reviewed with you, and a role nobody has used is taken away.
-
A separate account for admin work
Nobody does admin work with the account they read mail with. Admin accounts are separate, get the strictest sign-in rules and a second factor always, and are never used for everyday work.
-
Passwords in a vault
Admin passwords, local admin accounts and the keys to your firewall, your domain and your backups sit in a vault, not a spreadsheet. Only the people who need it can open it, every opening is logged, and a password is changed when a person leaves.
-
Our own keys first
As your IT provider we hold the most powerful accounts in your firm. So our engineers open client files only where a task needs it, that access is on record, and everyone who can see client data is bound to confidentiality in writing.
-
Emergency access, outside every rule
An emergency admin account that isn’t tied to any one person is set up before the first sign-in rule goes on, kept out of every rule, stored in the vault and watched, so a rule can never lock your firm out of its own tenant.
-
Old keys gone, yours stay yours
When you move to us, the previous provider’s admin accounts, delegated access and agents are removed, with a written check. Your tenant, your files and the admin access belong to your firm: if you ever leave us, you leave with all of it, documented.
On record
In your evidence file.
- Who holds admin rights, each by name and role, and since when
- That the passwords sit in the vault, and who can open it
- The log of admin use, for the day an auditor asks who did what
- Our own engineers’ access, on record
- The written check that the previous provider keeps no way in
The insurer’s and the auditor’s question about privileged access gets a list, not a shrug.
What usually goes wrong without it.
-
The admin password in a spreadsheet
One file on the share, called passwords, with every admin password in it. Whoever can open the share can open everything, and a leaver took a copy years ago.
-
Everyone an admin, for convenience
The admin role was given to whoever asked, and never taken back. The one phishing mail that works lands with an admin, and the attacker holds the keys from the first minute.
-
The provider’s account nobody removed
Months after a provider change, the old provider still holds an admin account, and a sync still runs under one of its logins. Old access doesn’t leave by itself.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Do we, the firm, get admin access to our own systems?
Yes. The admin access, the tenant and the documentation belong to your firm; if you ever leave us, you leave with all of it. We administer your systems; we don’t own the keys to them.
How many admin accounts should a firm with 50 people have?
As few as the work needs, each by name. The number matters less than the list: who holds which role, why, and when it was last reviewed. A role nobody has used in months is taken away.
Can your engineers read our client files?
They can reach what they administer, as with any IT provider. They open client files only where a task needs it, that access is on record, and everyone who can see client data is bound to confidentiality in writing.
What happens to the admin access if we leave 2nd wind?
It stays yours. You get the admin accounts, the vault, the documentation and a plan for the move, so the next provider doesn’t start from nothing, and our own access is removed, with a written check.
Start
Who holds the keys to your firm today?
In a first call we go through who has admin rights in your firm, where the passwords are kept, whether anyone would see their use, and what the list would look like written down.
- No first level
- No surprises
- Pilot before you buy