A working brief on identity and access alternatives

Most identity advice describes an arrangement that a small business cannot have. One account per person, single sign-on everywhere, automated joining and leaving, hardware keys in every pocket. Read it, look at the supplier portal that sells exactly one seat, and quietly do nothing.

That gap is worth taking seriously rather than pretending away. For each ideal below there is a second-best that is genuinely defensible, and a compensating check that recovers most of what the ideal was protecting. The failure is not choosing the second-best. It is choosing it and then not adding the check.

What to take away

When the application will not support a central login

Some systems will never join your directory. Old ones, small ones, specialist ones, and the bank.

The alternative is a password manager with a shared vault, an individual named owner for each entry, and a recorded list of who currently has access. That list is the compensating check, and it is what your leaver process reads instead of the directory.

What you give up is real: no automatic removal, no central log of who signed in, and rotation that depends on a person. So rotate on departure rather than on a schedule, since departure is the event that actually matters, and keep the entry count small enough that rotating is not a day's work.

When the license sells one seat

Shared logins are treated as a policy failure and are frequently a commercial fact. Pretending otherwise produces a rule everybody breaks.

The alternative is to make the shared login accountable even though it is shared. Give it a named owner. Put it in a shared vault so access is granted and withdrawn per person without the password circulating.

Where the service offers any activity log, agree that people announce use in a channel, so the log has something to be compared against. And price the second seat honestly once a year: a license often costs less than not knowing who did something.

The compensating check is the vault access list, reviewed whenever anyone leaves.

When hardware keys are impractical

Keys are the strongest option and they carry logistics: buying them, distributing them, replacing lost ones, and enrolling two per person so a loss is not a lockout.

Where that is out of reach, the alternative is an ordered retreat, and the order matters more than the label. The United States Cybersecurity and Infrastructure Security Agency ranks the common options on its multifactor authentication pages, a useful reference when you are deciding who gets what.

Put the strongest available factor on the accounts that can move money, administer systems, or control the domain, even if that means buying keys for three people rather than thirty. Use an authenticator application rather than codes by text message for everyone else.

Insist on two registered methods per person. Close the older sign-in paths that skip the check entirely, because a strong factor on an account that can still be reached another way is decoration. Which factors resist what is set out in phishing defense.

When there is no directory at all

Plenty of small businesses run on personal devices and a mail platform, with no central directory in any meaningful sense.

The alternative is to make the platform you already pay for the source of truth and point everything else at it. Everyone gets a named account there.

Every other service uses that address as the login. The recovery address on each service is that account, not a personal one. You now have one place to disable, giving most of a directory's practical value without buying anything.

The compensating check is a written list of every service that uses those addresses. Keep it somewhere other than in the platform itself.

This list is the least glamorous item in the National Institute of Standards and Technology's small business cybersecurity corner, which collects worksheets for exactly this sort of record. Without the list, disabling the account leaves accounts alive everywhere else.

When automated joining and leaving is out of reach

Provisioning integrations are the feature people most want and most often leave half-finished, and a half-finished integration is worse than none because it creates a belief that something is handled.

The alternative is a written runbook with a fixed order, owned by whoever runs payroll, since they always know first. Session revocation at the top, administrative groups and payment approvers next, then the list of applications that the directory does not cover.

The compensating check is timing it. Record the hours between the last working day and completion for each of the last three leavers. That number is the honest state of your leaver process, and it is more informative than any policy document.

The alternatives, at a glance

What is not an alternative

A password policy is not an alternative to a second factor, because the failure it addresses is not the one that happens. Telling people to be careful is not an alternative to removing access. A password spreadsheet is not an alternative to a vault, whatever it is called.

An integration configured once and never verified since is not an alternative to a runbook, because nobody can say which of the two is running.

Where you have chosen a second-best, say so in writing and record the trigger for revisiting it: a headcount, a new system holding customer data, or a first employee who can move money. Deciding once and reviewing on a trigger is a legitimate way to run this, as the operating discipline in security foundations controls sets out.

Common questions

Is a password manager really enough on its own?

For a very small business with few systems, a manager plus strong authentication on the mail platform covers a surprising amount, and it covers the applications that resist everything else. It stops being enough when you can no longer answer who has access to a given system without asking around.

Should we buy a platform we cannot fully use?

No. Buy against the applications it will actually cover, which is the count described in best identity and access software 2027. Paying for coverage you cannot reach creates the belief that the gap is closed, and that belief is the expensive part.

How do we know when to move up to the ideal?

When the compensating check starts being skipped. A list that goes unread, a rotation that never happens, or a leaver process that took three weeks are all the same signal, and it is a better trigger than headcount.

Do these alternatives look bad if we are asked about them?

A documented second-best with a working compensating check reads far better than an aspirational policy nobody follows, whether the question comes from a customer, an insurer or an auditor. Which features are worth adding first, when the time comes, is covered in identity and access features.