Intro lesson
Accounts, MFA and Removing Old Access
Give people the access they need, protect the sign-in and close every relevant access route when their role changes.
Reviewed September 2026 · 3 minute read
Prove who, then decide what
Authentication
Checks who is signing in. MFA uses different factor types; two passwords are not two factors.
Authorization
Decides what that identity may do. A successful MFA check does not mean someone needs administrator access.
Least privilege
Give the access needed for the approved task. Review it when the task or role changes.
Use named accounts and a separate privileged role for administration. Prefer phishing-resistant authentication, such as properly implemented passkeys or security keys, for sensitive access. Protect recovery methods too. Do not approve an unexpected prompt just to make it disappear.
Make the remaining passwords manageable
Use unique passwords stored in an approved password manager. Current NIST digital-identity guidance emphasizes length, blocking compromised choices and protection against guessing; it does not call for arbitrary periodic password changes. Change a compromised credential and follow the organization’s applicable requirements. A long password alone cannot stop phishing.
The email account is only one door
| Access route | What the authorized team should verify |
|---|---|
| Cloud identity and email | Disable the account as approved; handle active sessions and token revocation according to the service. Preserve business records under the retention plan. |
| VPN, remote tools and client systems | Remove grants and sessions. Check local accounts and any access that does not depend on the central identity. |
| Cameras and doors | Revoke app access, badges, mobile credentials and relevant PINs. Verify propagation and offline-controller behavior. |
| Shared secrets and equipment | Recover equipment; rotate exposed shared credentials where needed; retain an accountable completion record. |
Disabling an identity does not instantly invalidate every existing token or offline credential. Test the actual services and confirm remaining expiry windows or containment steps.
A contractor finishes today
The contractor had a cloud account, a remote-support tool and a door badge. Make a checklist with an owner and verification result for each route.
What should the check catch?
A central account may be disabled while an independent local login, remote tool or cached door permission still works. A complete handoff identifies those routes and confirms that the approved removal took effect.
Put it into practice
Check what you learned
Choose an answer for each question, then check your understanding. Your answers stay in this browser.
Read the answers and explanations
- No; authorization still follows the approved role.
Authentication and authorization solve different problems.
- No; check other sessions, tools, local accounts and physical credentials.
Independent and cached access can remain.
- Named accounts, task-appropriate privileges and reviewed access records.
Named access and role reviews let the business explain who could do what.
Sources and further reading
- NIST SP 800-63B-4: authenticators
Explains authentication and phishing resistance. Consult the applicable assurance requirements rather than treating every MFA method as equivalent.
- CISA and partner agencies: protecting MSPs and their customers
The joint advisory explains risks created by provider access and shared responsibilities. Read it when designing the provider/customer security agreement.
Keep your momentum
Ready for the next step?
If you can explain the example and your answer, try the next lesson. Revisit the feedback whenever you need it.
FryAVSI · Updated September 10, 2026
Reference this lesson or use a section’s direct link for a particular chart or example. How to cite an example.
FryAVSI · Northeast Ohio and beyond
Turn the learning into a working result.
Share the site, the requirement and the next step with our team.