Browser-saved passwords are not a business control
Chrome, Edge, and Apple Passwords are useful autofill stores, but they are not a shared business vault for payroll, banking, or infrastructure logins.
Identity & Access
MFA, SSO, passkeys, password vaults, and cutting access on time.
15 articles
Conditional Access for small tenants, without the theater
Security Defaults vs a short Conditional Access starter pack for Microsoft 365 shops under fifty people — MFA, legacy auth, and break-glass, not a 40-policy mess.
Five Entra sign-in checks worth doing every week
A five-minute Microsoft 365 sign-in log habit for small tenants: failed MFA, weird locations, legacy auth, admin devices, and new app consent.
1Password is (probably) the best password manager for home and work
An operator’s opinion: why 1Password is my default for personal use and small businesses, including the isolated Families account that comes with Business and MSP-provisioned seats.
Turn on MFA for Microsoft 365 before the next phish
A practical path to require multifactor authentication in Microsoft 365 for a small business, without locking everyone out on Friday afternoon.
Windows Hello for Business vs the passkeys path
How SMBs should use Windows Hello for Business, device-bound passkeys, and synced passkeys without creating three half-finished passwordless projects.
Shared admin secrets in a team vault
How small IT teams store shared admin passwords and API keys in a password manager without Spreadsheet-of-Doom habits.
JIT vendor access instead of standing VPN
Standing VPN accounts for vendors age badly. Just-in-time access with time bounds and approval beats a shared tunnel nobody reviews.
Time to rotate service account passwords
Inventory service identities, replace passwords where possible, and rotate remaining secrets without breaking the workloads that depend on them.
Phishing-resistant MFA for executives first
Why the CEO's mailbox is the first account that deserves FIDO2 or passkeys, not another SMS code.
Offboarding: make the access cut the same day
A practical same-day IT offboarding runbook for identity, sessions, SaaS, devices, shared secrets, and company data without deleting first and asking later.
Entra-only vs hybrid AD for small offices
A practical way for a 20-60 user firm to choose cloud-only identity, hybrid identity, and the right Windows device join without keeping domain controllers by habit.
When to force SSO for business SaaS
Single sign-on is not free to roll out — but neither is password sprawl. How SMBs decide which apps get SSO enforced and which can wait.
Break-glass admin accounts that actually work
How to create and maintain emergency Microsoft 365 admin accounts so you can recover the tenant without leaving a permanent backdoor.
Windows LAPS for SMB local admin passwords
How small offices rotate and escrow local administrator passwords with Windows LAPS through Intune — without a spreadsheet of doom on every workstation.