Identity is the real perimeter now

The consequence is not theoretical. Credential theft is the most common route into a small business, and what an attacker can do afterward depends entirely on what that account could reach. A user account with unnecessary administrative rights turns a phishing click into a domain-wide incident. Cleaning up identity buys more security per hour spent than almost anything else a small business can do, and it costs time rather than licenses.

Structure that reflects the business

We build organizational units around how you are actually organized, not around a diagram from a training course. Security groups map to job functions, and permissions are granted to groups only, never to individuals, because individual grants are invisible in a group audit and survive long after the reason for them has gone.

Group policy gets the same treatment. Most domains we inherit have dozens of policy objects, several of them contradictory, some applying to nothing, and none documented. We consolidate to a small set with clear names and written purposes, test the resulting policy against real accounts, and remove what is dead. A policy set an engineer can read in ten minutes is worth more than a comprehensive one nobody understands.

Hybrid identity, done once

Most Arizona businesses we work with are hybrid: a domain controller on site for file and application authentication, synchronized to Entra ID for Microsoft 365. That works well when there is one authoritative source and the synchronization rules are understood. It works badly when accounts are created in both places, when filtering excludes objects nobody knows about, or when password writeback was assumed but never enabled.

We establish a single source of truth, verify what is synchronizing and what is not, and document the rules. Some clients are ready to go cloud-only with Entra ID and Intune, which removes the domain controller entirely; we will tell you honestly whether your applications allow that yet, because plenty of line-of-business software still expects a domain. The wider platform view is on our Microsoft 365 page and at microsoft365.orcait.io.

Offboarding hygiene is where the most damage hides. When someone leaves, disabling their Windows account is not enough. Sessions and tokens need revoking, mailbox access needs converting, cloud application access needs removing, VPN and remote access certificates need revoking, shared credentials they knew need changing, and any personal permissions granted directly to them need finding. We write a checklist for your business and run it the same day, every time.

Privileged access gets separated properly: administrative accounts that are distinct from daily-driver logins, MFA on all of them, and a documented list of who holds what. Combined with the controls on our cyber security page, that is what stops one compromised mailbox becoming a company-wide event. A full inventory of accounts and permissions is part of every network audit we run.