RemoteIdentity and access
Attackers do not break in. They log in.
One reused password, one ex-staff account nobody switched off, one admin login used for email. That is how most businesses get breached. We set up who can sign in, from where and to what, then keep it right as people join, change roles and leave, mostly with the Microsoft 365 tools you already pay for.
- Passkeys and Conditional Access
- Leavers off on the day
- Mostly tools you already own
What changes
What is different once we are running it.
Pick one to see how it works day to day.
Every sign-in gets a real second check
Passkeys, Windows Hello or an authenticator app, not text codes. Sign-ins from odd places or unknown devices are blocked.
- Admins and finance moved to passkeys first
- Conditional Access rules in Entra ID
New starters work on day one
Tell us who is starting and what they do. Their account, email and access are ready before they arrive, matched to the role.
- Access by role, nothing extra
Leavers lose access as soon as you tell us
We switch off every login they had, keep their mailbox and files, and give you a record of what was removed.
- Same day shutdown
- A written record for your files
Admin rights stay locked away
Nobody uses an admin account for everyday work. Admin access is given only when a task needs it, and every use is logged.
- Separate admin accounts
- Restricting admin rights is an Essential Eight strategy
Contractors get time-boxed access
Outside people see only what they need, for as long as they need it. No shared logins.
- Guest accounts with an end date
AI agents follow the same rules
Copilot and AI agents log in, read files and act inside your systems. Each one gets only the access the job needs, a named owner and a way to switch it off fast.
- Set up when we roll out Copilot, not after
Passkey readiness
Who loses text-code sign-in, and when.
Pick how each group signs in today. The dates are Microsoft's, and the count runs from today.
Pick how each group signs in today. Not sure? Most businesses we look at have at least one group on text codes.
Ready for February 2027
0of 4 groups ready
- Most staffMicrosoft-provided text and voice codes retire on 31 January 2027. After that, people on text codes only must register a passkey, unless you pay for a telephony provider.Stops in 92 days
- Finance and payrollMicrosoft-provided text and voice codes retire on 31 January 2027. After that, people on text codes only must register a passkey, unless you pay for a telephony provider.Stops in 92 days
- Global administratorsKeeps working, but push and code prompts can still be phished. Move admins and finance to passkeys first.Upgrade first
- External guests and contractorsOne stolen password is enough to get in.Exposed now
Source: Microsoft Learn, retirement of Microsoft-provided SMS and voice authentication in Entra ID.
First month
Old accounts do not show up in a patch report.
Software flaws get a patch. Identity problems do not. Once an attacker holds a working login, they are not breaking anything, they are using access you already handed out. Here is what we clean up first.
Software flaws get a CVE number, a severity score and a patch. The leaver whose login still works, the shared admin password on a sticky note and the service account nobody remembers creating get none of that. They do not appear on a vulnerability scan and they do not get fixed on Patch Tuesday.
"There is no equivalent of a regular patch cycle for problems such as a dormant administrator account." Morey J. Haber, BeyondTrust, AISA CyberCon Review 2026-2027, p.63.
- Accounts belonging to people who have left
- Admin rights handed out "just for a day" and never taken back
- Shared logins, so every action traces back to one person
- Text message codes, upgraded to passkeys or an authenticator app
- Service and app accounts with more access than the job needs
- Guest and contractor accounts with no end date
38%
of small business breaches started with compromised credentials.
Verizon 2026 DBIR73%
of ransomware victims had an infostealer infection or compromised credentials.
Verizon 2026 DBIRInsurers and auditors
It is what insurers and auditors ask about first.
Cyber insurers ask whether you use multi-factor authentication and limit admin access before they quote. Both are Essential Eight strategies, both carry into ASD's new Essentials series, and both are in SMB1001. We run these controls for our own business too, which is part of how Real Bytes holds SMB1001 Gold.
Patching closes the first door. In the 2026 Verizon DBIR, exploited vulnerabilities became the top way in, at 31% of breaches, and stolen or abused credentials still showed up in 39% of breaches overall. Identity decides how far someone gets once they are through.
How it works
Done in order, without locking anyone out.
- Step 1Map who has access
Every account, admin role, guest and app, and how each one signs in today.
- Step 2Fix sign-in
Passkeys and Conditional Access, starting with admins and finance.
- Step 3Tidy access
Old accounts closed, admin rights cut back, guests given end dates.
- Step 4Keep it right
Starters, movers and leavers handled the same day, every time.
Cybersecurity
Eight layers. One team running them.
Every layer is run by the same Brisbane engineers who look after your IT, so an alert, a leaked password and a suspicious email all land with people who already know your business.
- One Vision 2030The plan that joins the security work up, reviewed every month.
- Managed Detection & Response24/7 watch on devices and accounts, with a person who acts.
- Identity & Access ManagementPasskeys, tidy access and leavers switched off on the day.You are here
- Email SecurityStop fake invoices sent from your own domain.
- Human Risk IntelligenceSee which people carry the most risk this month.
- Security Awareness TrainingShort monthly lessons and practice scam emails.
- Data Loss PreventionWarn before client data leaves, block the risky cases.
- Zero Trust ArchitectureOne stolen login should not open the whole business.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask before they call.
What is identity and access management?
Making sure the right people can sign in to the right things, and nobody else can. It covers how staff prove who they are, what each person can open, and switching access on and off as people join, move and leave.
What is changing with text message codes?
Microsoft made passkeys the default sign-in from 1 September 2026. Microsoft-provided text and voice codes in Entra ID retire on 1 February 2027 for most users, and on 1 July 2027 for Global Administrators and external users. After that, anyone whose only second check is a text or call must register a passkey before they can sign in, unless the business pays for a separate telephony provider.
Why does this matter so much?
Most attacks now start with someone signing in using a stolen password, not breaking through a firewall. In the 2026 Verizon DBIR, 38% of small business breaches started with compromised credentials, and 73% of ransomware victims had an infostealer infection or stolen credentials. Strong sign-in checks and tidy access are the cheapest way to stop that.
How does this relate to the Essential Eight?
Two of the Essential Eight strategies are about identity: multi-factor authentication and restricting administrative privileges. They carry straight into ASD's new Essentials series. The work on this page is how we get them to the level your business needs.
What tools do you use?
Mostly what you already pay for in Microsoft 365: Microsoft Entra ID for sign-ins and access rules, and Intune for device checks. If you use Google Workspace, we set up the equivalent controls there.
Will this make signing in harder for staff?
Usually easier. With passkeys and single sign-on, staff sign in once with their face, fingerprint or phone and get to their apps without juggling passwords.
Is text message MFA still okay?
It is better than nothing, but it can be phished and SIM-swapped, it does not meet the higher Essential Eight maturity levels, and Microsoft is retiring its own text and voice codes in 2027. Insurers and larger customers now ask which type of multi-factor you use, not just whether you have it. We move people to passkeys or an authenticator app, starting with admins and finance.
Can you stop sign-ins from personal or unknown devices?
Yes. With Conditional Access and Intune, company data opens only on laptops and phones we manage that are encrypted and up to date. Sign-ins from odd places or unknown devices are blocked or asked for more proof.
How do contractors and guests get access?
With their own guest accounts that see only what they need and come with an end date. No shared logins, so every action traces back to one person.
Next step
Not sure who can get into what right now?
Talk to us. We will look at your sign-ins and admin accounts and tell you where the gaps are before February 2027.
Keep reading
- Zero trust Limit what one stolen login can reach.
- Managed detection and response Catch the login that should not have worked.
- The ASD Essentials series Where MFA and admin rights go next.
Checked 30 October 2026. Microsoft dates from Microsoft Learn. Breach figures from the Verizon 2026 DBIR. Microsoft Learn: passkeys by default and retirement of SMS and voice; Verizon 2026 DBIR, small business findings (Cyber Readiness Institute); Verizon 2026 DBIR, biggest shifts; Verizon 2026 DBIR patching figures (Passwork summary); AISA CyberCon Review 2026-2027