Identity and access management, or IAM, is how a business manages digital identities and controls what they can access. It covers creating accounts, verifying identity, assigning appropriate permissions, reviewing access, and removing it when the need ends. The identities include employees, contractors, applications, and automated services.
For a small business, the practical questions are straightforward: who can sign in, what can they reach, and should they still have that access?
Blue Lantern Security runs recurring checks that help answer those questions. Its daily identity scan checks MFA registration and dormant accounts in Google Workspace or Microsoft Entra. Separate AI exposure checks help review connected application permissions. Your administrator uses the findings to fix access in the underlying systems.
How does IAM work?
IAM combines an account's lifecycle with decisions about identity and access. A new employee needs an account, a reliable way to sign in, and permissions appropriate to their job. Those permissions should change when their responsibilities change and end when they leave.
Two terms describe different parts of the sign-in process:
| Term | Question it answers | Small-business example |
|---|---|---|
| Authentication | Is this the person or application it claims to be? | An employee signs in with a passkey or completes MFA |
| Authorization | What is this identity allowed to do? | The employee can read a project folder but cannot change payroll settings |
Microsoft's IAM fundamentals guide explains this distinction. A valid sign-in should not automatically give an identity broad access. Someone can authenticate correctly and still hold permissions they no longer need.
For example, a contractor might finish a project while their account remains enabled. A writing assistant might retain access to work files after a team stops using it. Neither requires a stolen password to become an access problem: the permission itself needs review.
What IAM work should a small business start with?
Start with the directory and important services the business already uses. If Google Workspace or Microsoft 365 manages your work accounts, use its controls to set access requirements and remove unnecessary permissions. Build a repeatable review around those controls.
Check MFA, especially for administrators
Multifactor authentication adds protection beyond a password alone. Begin by finding accounts without a registered method, giving administrators particular attention because their permissions can affect other users and security settings.
Then check the policy that requires MFA. Registration and enforcement are separate questions: a coverage report showing registered methods does not establish that every relevant sign-in requires them. The MFA guide for small businesses explains what each signal tells you.
Review accounts that appear unused
An enabled account with no recent sign-in deserves an owner and a reason to exist. It might belong to a former employee, a contractor who finished their work, or someone who has changed roles.
It could also be an intentionally infrequent account. Before disabling it, confirm whether it supports an approved emergency-access arrangement or a business process. A dormancy finding starts the review; it does not make that decision for you. The dormant-account review guide walks through ownership, dependencies, and follow-up.
Review applications as well as people
An app can retain permission to read files, access mail, or act on a user's behalf. Record who owns the connection, what work it supports, and whether its permissions fit that work.
This is especially relevant to AI assistants that connect to work accounts. Approval to use an AI tool is only part of the decision; the particular connection's access matters too. Start with the guide to what AI apps can access in Google Workspace and Microsoft 365.
What does Blue Lantern Security check?
The daily identity posture scan and the separate AI exposure scan provide different evidence:
| Check | What you can review | What your administrator does next |
|---|---|---|
| MFA registration | Directory users without a registered method; admins without MFA are critical findings | Help users enroll and check the provider's enforcement policies |
| Dormant accounts | Enabled accounts with no sign-in for 90 days, or 30 days for admins | Confirm ownership, purpose, and dependencies; disable unused accounts or reduce unnecessary privileges |
| AI application access, when separately enabled | Detected AI apps and granted permissions in the connected environment | Assess the scope and business need; restrict or revoke access where appropriate |
The identity scan covers the connected directory, including users whose mailboxes are not monitored. Its MFA and dormancy findings appear under Identity in the Monitoring Hub, where you can filter the results and export a roster for review.
To enable it, open your Gmail or Outlook organization integration's settings and turn on the daily identity posture scan. The Google integration uses its existing directory scope. For Microsoft 365, the optional checks require the AuditLog.Read.All application permission with admin consent; dormancy also requires an Entra ID P1 or P2 license on the tenant. The identity monitoring setup guide covers these prerequisites.
Check the timestamp and status of the latest run before relying on a finding. After a fix, look for the updated result in the next successful daily scan; upstream data availability can also affect what is reported.
Where do the other IAM controls live?
Google Workspace, Microsoft Entra, and your other business systems remain responsible for sign-in policies, account creation, access assignments, and account removal. Blue Lantern Security helps you review selected gaps; your administrator carries out the changes.
Its separate cloud-permission tools support more specific investigations, such as finding risky IAM permissions in AWS or reviewing privileged service principals in Azure. Those have their own setup and scope; they are not part of the daily directory identity scan.
An example of turning findings into action
Consider an illustrative business with 25 employees, several contractors, and a shared project drive. Its review identifies an admin without MFA registration, an enabled account belonging to a former contractor, and an AI app connected during a completed trial.
Each needs a different follow-up:
- Admin account: confirm the user's registration status, arrange a suitable method and recovery option, and verify the enforcement policy.
- Contractor account: confirm the engagement has ended, check whether business information needs transferring, and remove access through the offboarding process.
- AI connection: ask the app's owner whether it is still needed, inspect its permissions, and revoke unnecessary access in the provider's admin controls.
A useful review record includes the account or app, the finding, the owner, the decision, and the follow-up evidence. Record what changed and why when you mark a finding resolved.
Keep access review part of ordinary business work
Review access when someone joins, changes roles, or leaves, and when a new application connects to company data. Add a recurring review to catch things those events miss. Daily scans can supply observations between reviews; urgent findings still need a responsible person to act.
A practical starting point is to check administrator MFA, review enabled dormant accounts, and identify connected apps that no longer have a business purpose. Use Blue Lantern Security identity monitoring to make those account checks repeatable, and keep each fix with the administrator who controls the affected system.