Identity and Access Management for SMB Clients

Identity is the perimeter now

A typical SMB client in 2026 has no server room worth defending. Email, files, accounting, CRM, and the line-of-business app all live in someone else's cloud, reachable from any device on any network with nothing but a username, a password, and whatever second factor you enforced. Stolen or phished credentials remain the most common way into an SMB, and the dominant technique – adversary-in-the-middle phishing that steals the authenticated session – walks straight past SMS and push prompts. Whoever controls the identity controls the business.

The practical consequence: IAM is one buying conversation, not five products. MFA, SSO, conditional access, privileged access, and Zero Trust are layers of the same build, and clients buy it best when you sell it as a sequence.

The build-out, in order

One identity provider. Every client gets exactly one source of truth for user accounts – for almost every SMB that is the Microsoft 365 tenant or Google Workspace. Sync or retire the on-premises directory, kill shared mailboxes used as logins, and make every SaaS app trust that provider instead of keeping its own password list. Nothing further works until this is true.

MFA on every account. Enforced by policy, not by asking nicely; no SMS; number matching on push prompts so users cannot approve blind. Admins, finance staff, and executives – anyone worth phishing deliberately – get phishing-resistant methods: FIDO2 keys, passkeys, or platform authenticators bound to the device. Hardware keys run roughly $25–60 each; a set for a client's admins costs less than an hour of incident response.

SSO for SaaS apps. Connect each business application to the identity provider through SAML or OIDC, with automated provisioning where the vendor supports it. This is what makes offboarding a single switch and turns shadow IT into managed IT. Expect the "SSO tax" – many vendors sell SSO only on a higher plan – and budget for the upgrades.

Conditional access and device compliance. Rules that decide whether a sign-in is allowed at all: block legacy authentication protocols, require a managed and compliant device for company data, refuse sign-ins from countries the client has no business in, and step up authentication for risky sessions.

Least privilege and privileged access. Nobody works day to day with admin rights – not on the laptop, not in the tenant. Admins get separate, named admin accounts, standing global-admin roles shrink to two break-glass accounts in the password vault, and elevation is just-in-time and time-boxed. PAM tooling that removes local admin from endpoints and grants it per task closes the last common gap.

Joiner, mover, leaver. Identity decays without process. HR triggers a ticket for every hire, role change, and departure; the leaver ticket has a clock – account disabled within one business hour of notice, sessions revoked, licenses reclaimed within a week – and access is reviewed quarterly, with dormant accounts disabled after 45 days. Tie this to your client onboarding process so it is written in the first 30 days and lives in the client's documentation.

What the insurer and CIS actually require

Every cyber insurance application since about 2022 asks the same three questions: is MFA enforced on email, on remote access, and on privileged accounts. As of 2026 more carriers add whether admin MFA is phishing-resistant, whether privileged accounts are separated from daily-use accounts, and how quickly departed employees lose access. A weak answer costs the client a declined application or a 40–100% premium hike; a strong answer is the layered build above, item for item.

CIS Controls v8.1 says the same thing in control language. Control 5 covers account management – an inventory of accounts, unique credentials, dormant accounts disabled, admin rights restricted to dedicated accounts. Control 6 covers access control – a documented grant and revoke process, and MFA for externally exposed applications, remote access, and administrative access. All of those safeguards sit in Implementation Group 1, the floor every framework expects.

Your own tenant first

You cannot sell identity hygiene from a shop that fails its own test. Partner access to client tenants runs through GDAP – per-client, role-scoped, time-boxed – never legacy delegated admin. Every technician has a named account; there is no shared support login and no standing "msp-admin" global admin parked in every client tenant. Technician MFA is phishing-resistant across the board, privileged roles activate just-in-time, and a per-client break-glass account lives in the vault with its use alerting. The full hardening sequence is in securing your MSP.

Packaging and pricing

Identity belongs in the standard per-seat offer, not in an optional tier a client can decline. Where you run a base seat plus a security tier, the identity bundle – MFA, conditional access, SSO management, quarterly access reviews – is typically a $5–15 per user per month uplift as of 2026, most of it service rather than licensing, since the core licensing already sits in the business-tier Microsoft bundle most clients own; premium identity licensing for risk-based policies and just-in-time elevation adds roughly $6–9 per user at list where a client needs it.

The rollout is a project, priced separately: typically $2,500–10,000 for a 25–100 user client, or $75–150 per user, covering discovery, policy design, pilot, enforcement, and the helpdesk surge. Do not fold the project into the monthly fee; a free rollout teaches clients that identity work is free.

Rollout order that keeps the helpdesk quiet

Every identity change generates tickets; sequencing decides how many.

1. Inventory first – pull 30 days of sign-in logs to find legacy-protocol clients, service accounts, shared mailboxes, and every app that will break when authentication changes. The copier that scans to email is the classic surprise.
2. Communicate, then register – a two-week window where users enroll MFA methods with written guidance, while conditional access runs in report-only mode so you can see what would have been blocked.
3. Enforce for admins first, then a pilot group of friendly users, then everyone – on a Tuesday, with an extra technician on the queue. Expect a 15–30% ticket spike in the enforcement week that decays within two.
4. Disable legacy authentication once the inventory says nothing depends on it.
5. Add SSO one application at a time, starting with the apps that have the most users and already support it.
6. Turn on device compliance rules after two to four weeks in report-only.
7. Remove local admin rights last, once SSO and self-service password reset have removed the usual excuses.
8. Hand the client's HR contact the joiner-mover-leaver procedure and book the first quarterly access review.

Bottom line

For a cloud-first SMB the identity provider is the perimeter, and the layers – one provider, MFA everywhere with phishing-resistant methods for admins, SSO, conditional access, least privilege, and a leaver process with a clock – are one product sold in sequence. It is the exact list insurers and CIS IG1 require, it costs the client a modest per-seat uplift plus a one-time project, and it only works if your own tenant already passes the same test. Roll it out in the order above and the helpdesk survives it.