Marisol runs operations at a 60-person architecture firm in Los Angeles. She’s made up, but her problem isn’t. Three years ago, the firm moved everything to the cloud: drawings, contracts, client emails, the lot. It was the best decision they’d made in years. Architects could open a model from a site visit, contractors could drop files straight into project folders, and nobody missed the old server humming in the supply closet.
Then one afternoon a client asked a simple question on a call. Who, exactly, could see their building plans? Marisol realised she had no idea.
Why the old office door doesn’t protect you anymore
That’s a common moment for growing companies. Once your data lives across Microsoft 365, a couple of shared drives, a CRM, an invoicing app and a dozen other tools, locking the office door doesn’t mean much. In cloud environments, a username and a password usually stand between an outsider and your files.
Cloud identity and access management, or IAM, tightens that up. Every person, app, and automated process has to prove who it is, and then it can only reach what it genuinely needs. Some firms handle IAM with their own IT team. Others get help from a provider of cloud services in Los Angeles or wherever they’re based. Marisol’s firm ended up doing a bit of both.
How it got messy without anyone noticing
Nobody at the firm had done anything reckless. Access just crept.
An architect needed a file in a hurry, so someone shared the whole folder “for now.” A project manager added a structural engineering contractor to a client folder in 2023 and never took them off. When a senior designer left, IT set up her replacement by copying her permissions, including a few odd extras she’d picked up over five years. Every one of those decisions made sense at the time.
When Marisol’s IT lead finally compared every active account against the current staff list, two names jumped out. Both belonged to architects who’d left the firm, one of them more than a year earlier. Their logins still worked. Security people worry about that scenario most, because a valid password in the wrong hands doesn’t look like an attack. It looks like an employee logging in.
The audit turned up other surprises. A few teams had connected handy apps to the company drive: a PDF markup tool, a scheduling app, an AI note-taker that joined Zoom calls. Several of those apps had asked for, and got, permission to read and edit pretty much everything. Six people also held full admin rights. IT had handed most of them out years ago “so they don’t have to keep asking.” If any one of those six clicked a convincing phishing email, an attacker would get the keys to every project the firm had ever done.
The fixes that made the biggest difference
Passkeys instead of text-message codes
The first change, and the one staff noticed most, was the login itself. The firm had used text-message codes as its second step. That beats nothing, but attackers can intercept those codes, or trick people into typing them into a fake page that looks exactly like the real one.
So they switched everyone to passkeys and a handful of hardware security keys. These work differently. The device ties each passkey cryptographically to the genuine website, so if someone types their details into a lookalike page, the login simply fails there. A few people grumbled in the first week. Then they noticed they typed their password far less often, and the grumbling stopped. The change matters more now, too, because AI can write a polished, personalised phishing email in seconds, with no typos to give it away.
Only the access each job needs
The next change proved tougher culturally: giving people only the access their job actually needs. The jargon calls it role-based access control and “least privilege,” but in practice it meant asking awkward questions.
Did the interns really need every project since 2019? (No. They now see only the projects they work on.) Did the office manager need to edit the accounting system, or just view invoices? Did anyone need permanent admin rights? The firm cut those six admin accounts to zero. When someone needs to do maintenance now, they request elevated access through a “just-in-time” process. A manager approves it, and it expires automatically a few hours later.
Connecting HR and IT
Previously, when someone joined, IT got an email and set things up by hand, often a day or two late. When someone left, IT got another email and worked through a checklist, which is how the two old accounts slipped through.
Now the firm links its identity system to HR records. A new hire’s accounts and licences appear on their first morning, matched to their role. When HR marks someone as leaving, the system ends their sessions and switches off their access across every connected app at once. The firm learned one lesson the hard way, though: this only covers apps that connect to the central system. Two older tools didn’t, so they still need a manual step on the leavers’ checklist. Getting as many apps as possible under the central login turned out to be half the battle.
Watching for anything odd
The last piece runs quietly in the background. Instead of checking someone once at login and trusting them all day, the system keeps an eye on context. Where does this login come from? Is it a company laptop with up-to-date software, or an unknown device? Does this behaviour look normal for this person?
If an account that always signs in from Pasadena suddenly starts downloading whole project archives at 2 a.m. from another continent, the system can ask for another check or shut the session down. It has flagged two odd logins so far. Both turned out to be staff travelling, which is fine. That’s the point.
Don’t forget the accounts that aren’t people
Most companies skip this part, and it keeps getting bigger.
Modern cloud setups run on a lot of non-human accounts: service accounts that move files between systems, API keys that let apps talk to each other, scheduled scripts, and now AI agents that log into tools and act by themselves. Most people underestimate how many exist. CyberArk’s 2025 research found that machine identities outnumber human ones by about 82 to 1 in the average organisation. Someone often set them up once, gave them broad access and then forgot about them, and nobody has changed their keys in years.
Marisol’s team found an old integration that still had full access to their file storage. It belonged to a rendering service the firm had stopped using in 2022, and nobody remembered it existed. As businesses plug more AI agents into their systems, keeping those permissions tight becomes a big part of AI agent security. Treat each one like a new employee: what does it actually need to touch, and who takes responsibility for it?
Old sharing links
They also went hunting for old sharing links. Over three years, staff had created dozens of “anyone with the link can view” shares to send drafts to clients and contractors. Most had served their purpose long ago, and a few pointed at entire project folders. The team shut down the ones nobody needed and moved the rest behind named access.
How they rolled it out without stopping work
They didn’t try to change everything in one weekend. The order they followed suits most small and mid-sized businesses.
Single sign-on came first. They moved every app they could onto one identity provider, which gave them one place to manage passwords, groups, and session timeouts, and one switch to flip when someone left. If you’re still choosing a platform, a checklist for picking identity governance solutions makes a good starting point. Roles came next: they mapped each job to a sensible set of permissions and removed standing admin rights. After that, everyone moved to passkeys and security keys, including the partners, whose accounts make the most valuable targets of all. Finally, they set a reminder for every 90 days. Each team lead gets a list of who can access what and confirms it still makes sense.
The whole thing took about two months, alongside normal work. It wasn’t glamorous. A lot of it meant spreadsheets and slightly awkward conversations about who really needed what.
But the next time a client asked who could see their plans, Marisol pulled up the answer in about thirty seconds: the project team, two named contractors, and nobody else. The client said it was the most reassuring thing they’d heard all week.
Related: IT Health Check: 5 Critical Areas Every Business Should Review
