Identity and Access Management in Microsoft 365 for UK SMEs

If your business runs on Microsoft 365, identity is your new perimeter. Attackers do not need to break your firewall when they can log in as you. The good news: a handful of well-chosen controls will shut most of that risk down without slowing people.

This guide gives UK SMEs a plain-English path to stronger Identity and Access Management in Microsoft 365. We cover the 4 As, why MFA is non-negotiable, how to use conditional access wisely, and quick wins that map to Cyber Essentials. No jargon, just steps you can take today.

The 4 As of IAM, explained simply

Identity and Access Management (IAM) rests on four pillars often called the 4 As.

• Authentication: Proving a user is who they say they are. In practice, this means passwords plus multi-factor authentication (MFA), and ideally phishing-resistant methods such as Microsoft Authenticator number match or FIDO2 security keys.
• Authorisation: Deciding what a proven user can access. Use least-privilege, role-based access control (RBAC), and just-in-time elevation for admins.
• Administration: How identities, roles, and policies are created and maintained. Think joiners-movers-leavers, automated group membership, lifecycle rules, and emergency access.
• Auditing: Recording and reviewing sign-ins, changes, and access to catch misuse and prove compliance. Enable unified audit logs, alert on anomalies, and review regularly.

Keep these four in balance. Strong authentication without auditing leaves blind spots. Careful authorisation without clean administration creates drift.

MFA is non-negotiable

Should you enable MFA? Yes. MFA blocks the vast majority of account-takeover attempts. Passwords are phished, reused, and guessed; a second factor stops that. In Microsoft 365, enable security defaults for very small tenants or use conditional access for granular control.

Is MFA a legal requirement in the UK? There is no single law that forces every SME to use MFA. However, UK guidance and industry schemes strongly expect it. Cyber Essentials requires MFA for cloud services like Microsoft 365 and treats it as a baseline. Many regulators and insurers also expect MFA. So while not universally mandated by statute, it is effectively required if you want to meet common standards, reduce risk, and satisfy insurance.

How to check MFA settings in Microsoft 365:

• Admin portal route: Microsoft Entra admin centre, Protection, Conditional Access, Policies, then review policies that require MFA; also check Authentication methods.
• Per-user legacy view: Microsoft 365 admin centre, Users, Active users, Multi-factor authentication, to see any remaining per-user settings.
• Sign-in logs: Entra admin centre, Monitoring, Sign-in logs; add the Authentication requirement and Result details columns to confirm MFA prompts and outcomes.

Tip: Prefer policy-based MFA over per-user toggles. Use number matching and block SMS where possible.

For a quick primer on rollout options, see our practical note on MFA setup for small teams in our Microsoft 365 security resources.

Conditional access that works with your day

Conditional Access (CA) lets you apply the right control at the right time, based on context. Start with three powerful signals:

• Location: Mark your office IPs as trusted, and flag unusual countries. Do not blanket-allow offices without MFA, but you can reduce prompts where risk is low.
• Risk: If Microsoft Entra flags a risky sign-in or risky user, require MFA, force a password reset, or block access until investigated.
• Device compliance: Allow access only from compliant devices enrolled with Microsoft Intune or meeting minimum standards. For BYOD, use app protection policies and session controls.

Practical starter policies:

• Require MFA for all users, all cloud apps, excluding break-glass accounts.
• Block legacy authentication protocols for everyone.
• Require device to be marked compliant for admin portals and high-risk apps.
• Elevate controls for privileged roles, such as requiring a compliant device plus MFA and disallowing persistent sessions.

Least-privilege without the pain

Give users the minimum they need to do their job, then review. Use built-in roles, avoid permanent Global Administrator, and enable Privileged Identity Management (PIM) where licensed to provide just-in-time access with approval and time limits. Keep distribution list owners and SharePoint site owners under control; sprawl leads to accidental oversharing that Copilot and search can surface more easily.

Quick wins you can do this week

• Block legacy authentication: Disable basic auth for Exchange and other services. This removes a major attack path that bypasses MFA.
• Turn on risk-based MFA: Use CA to require MFA on risky sign-ins, not only at first login each day.
• Protect break-glass accounts: Create two emergency accounts with long, unique passwords, no MFA, and strict use policy. Exclude them from CA, but store credentials offline in a secure location, monitor any sign-in, and test twice a year.
• Enforce number match: In Microsoft Authenticator, enable number matching and location to defeat push fatigue.
• Clean up admin roles: Reduce Global Administrators, move to least-privilege, and require just-in-time elevation.
• Review external sharing: In SharePoint and OneDrive, limit anyone links, prefer specific-people sharing, and label sensitive content.

If you would like help implementing these steps across identities, devices, and cloud apps, our Microsoft 365 security team can set policies and monitor them around the clock.

Map to Cyber Essentials

Cyber Essentials expects strong access controls for cloud services:

• MFA on Microsoft 365 accounts.
• Principle of least-privilege, especially for admin roles.
• Secure configuration including blocking insecure protocols and services.
• Patch and device controls that feed into compliant device checks.
• Logging and monitoring as part of spotting unusual activity.

Put simply, if you enable MFA everywhere, block legacy auth, apply least-privilege, and log what matters, you are aligned with the core access requirements.

What good auditing looks like

Turn on unified audit logging and keep it for as long as your licence allows. Watch for:

• Impossible travel and unfamiliar sign-in properties.
• New forwarding rules in Exchange.
• Consent to third-party apps with wide scopes.
• Role changes and new admin assignments.

Feed those signals to a monitored service so action is taken promptly, day and night. If you want managed, 24/7 coverage, our managed security service with SOC analysts watches identity, email, and endpoints together so early signs become fast containment, not Monday-morning surprises.

FAQ: quick answers

• What are the 4 pillars of IAM, the 4 As of IAM? Authentication, Authorisation, Administration, and Auditing.
• Is MFA a legal requirement in the UK? Not universally by law for all businesses, but it is required by schemes like Cyber Essentials and commonly expected by regulators and insurers.
• Should you enable MFA? Yes, for every Microsoft 365 user and admin account. Use modern methods and number match.
• How do you check MFA settings? In Microsoft Entra, review Conditional Access policies and Authentication methods, and confirm enforcement in Sign-in logs; tidy any per-user legacy settings in the Microsoft 365 admin centre.

Where to go next

Start with MFA for all, block legacy auth, and create clear conditional access policies that reflect your risk. Then trim admin rights and enable auditing you actually review. If you want a joined-up approach across identities, devices, and data, explore our Microsoft 365 security services for practical help, or speak to us about identity and access management aligned to zero trust access principles.