Identity Is the New Security Perimeter: Why MFA Alone Isn’t Enough

When investigating a suspected account compromise, asking whether multi-factor authentication (MFA) was enabled is only the starting point. Security teams also need to understand what the identity could access, which privileges it held, whether active sessions remained open and how quickly its reach could be restricted. These factors often determine whether a security event remains contained or develops into a wider business incident.

MFA is essential, but it is not a complete identity security strategy. Organisations no longer operate behind a single, defined network boundary. Employees connect from multiple locations and devices while contractors, suppliers and partners require access to business systems. Applications, service accounts and automated processes also interact with sensitive information, often without direct human oversight.

Identity has therefore become one of the organisation’s most important security boundaries. MFA strengthens that boundary by adding another check at sign-in, but it does not control what happens after access is granted. It cannot determine whether an account has excessive permissions, whether those permissions remain justified or whether the account’s behaviour continues to be trustworthy.

For incident responders, this distinction matters. Authentication confirms that an access request met a set of requirements, but it does not confirm that every subsequent action was safe, necessary or intended. The question for security leaders is no longer simply whether an identity can authenticate. It is whether the organisation can govern that identity throughout its entire relationship with the business.

MFA Solves One Important Problem

MFA reduces reliance on passwords by asking users to provide another form of verification. This makes unauthorised access more difficult when passwords are stolen or exposed, but authentication still answers only one question: can this person or process meet the sign-in requirements at this point in time?

Identity security must answer several others:

• Should this identity still exist?
• What should it be allowed to access?
• Are its privileges appropriate for its role?
• Does the device or sign-in context introduce additional risk?
• When should its access be reviewed or removed?

An account can pass MFA and still present significant risk. Employees may retain permissions from previous roles, contractors may keep access after a project ends and administrators may hold privileges that they rarely need. During an investigation, these gaps become important because passing authentication does not guarantee that every action taken through the account was safe or intended.

The organisation also needs to understand the identity’s permissions, activity and relationships across the environment. MFA verifies an access request at a particular moment. Effective identity security governs what that access can become over time.

Security Controls Must Work for People

Identity security also needs to account for the employee experience. Controls that create excessive friction can encourage workarounds, disrupt productivity and reduce attention to authentication requests.

Repeated or poorly timed MFA prompts may frustrate users and make it harder for them to distinguish legitimate requests from suspicious ones. The answer is not to challenge every user at every opportunity, but to apply additional verification when the identity, context or requested action creates a meaningful increase in risk.

A routine sign-in from a recognised device should not necessarily receive the same treatment as a request for privileged access from an unusual location. The identity may be the same, but the context and potential impact are different. Stronger security is therefore not about generating more prompts. It is about applying the right control at the right time.

Authentication Is a Checkpoint, Not Permanent Trust

A successful sign-in does not mean an identity remains safe indefinitely. Once access is granted, security teams need to monitor what the identity does and respond if its behaviour or risk changes. The organisation must be able to investigate suspicious activity and restrict access quickly without treating successful authentication as permanent evidence of trust.

Context-aware policies should consider the identity, device, requested resource and privilege level. Microsoft Entra Conditional Access, for example, brings identity-driven signals together to support access decisions and enforce organisational policies. Depending on the circumstances, the appropriate response may be to allow access, require stronger verification or block the attempt.

For incident responders, sign-in is only one part of the investigation. Active sessions, application access and account privileges all affect the potential scope of an incident. Blocking further logins may not be enough if existing sessions or tokens still provide access.

This leads to a straightforward principle: an identity should not be treated as permanently trustworthy because it passed one authentication checkpoint. Trust must remain proportionate to the identity’s context, activity and potential impact.

The Identity Perimeter Extends Beyond Employees

Identity security is often discussed in terms of employees, but the identity perimeter is much broader. It can include:

• Employees and administrators
• Contractors, partners and suppliers
• Guests and external collaborators
• Service and application accounts
• Workloads and automated processes
• AI agents operating with access to systems or data

Every identity can provide a route to systems, applications or information. Each needs a clear owner, a legitimate purpose and an appropriate level of access. Without those basic controls, organisations can accumulate identities whose business purpose is unclear but whose permissions remain active.

This is particularly important when incidents involve non-human identities. Service accounts and automated processes may not behave like employees, but they can hold extensive permissions and perform actions across the environment. Their ownership, purpose and access requirements must therefore be understood before an investigation begins.

For responders, the key questions are practical:

• Which identity performed the activity?
• Who owns it?
• What could it access?
• Which privileges did it hold?
• Can its actions be traced?
• How can its access be restricted safely?

Without clear answers, investigation and containment become unnecessarily difficult. Identity governance is therefore not a separate administrative exercise. It directly influences how quickly the organisation can understand an incident, determine its potential scope and take action without causing avoidable disruption.

Where an MFA-Only Strategy Leaves Gaps

MFA can function as intended while significant identity risks remain. During an incident, the potential impact of a compromised account often depends less on how the account authenticated and more on what it could access afterwards.

Legitimate Access Can Still Be Excessive

A user may authenticate correctly but still hold more access than their role requires. Permissions often accumulate as employees move between teams, support projects or take on new responsibilities.

If that identity is compromised, each unnecessary permission increases the potential impact. Applying least privilege limits the reach of a compromised account by ensuring that each identity has only the access required for its current purpose. This reduces exposure while giving responders a clearer understanding of what the account should be able to do.

Privileged Identities Increase Potential Impact

Administrative identities require tighter control because they can make extensive changes to systems, security settings and data. MFA protects the sign-in, but it does not determine whether privileged access should be permanent, temporary or removed.

Microsoft Entra Privileged Identity Management supports just-in-time and time-bound privileged access, approval-based activation and access reviews. These controls can help reduce the risks created by excessive, unnecessary or misused privileged permissions. [learn.microsoft.com]

A compromised administrator account is more difficult to contain than a standard user account because it may provide access to critical systems and security controls. Clear ownership, limited privilege and strong activity visibility are therefore essential. Privileged access should be treated as a temporary business requirement, not an entitlement that automatically persists.

Trust Can Change After Authentication

A sign-in may appear legitimate, but later activity can raise concerns. Security teams need to track what an identity does after access is granted, not just whether it passed authentication.

Connecting identity signals with wider monitoring and response capabilities can help responders identify suspicious behaviour, investigate related activity and contain compromised access. This is where Microsoft Entra ID can support stronger identity and access management through policy, visibility and governance capabilities.

The specific controls used should reflect the organisation’s operating model and risk profile. The strategic issue is not whether every available capability has been enabled, but whether the identity environment gives security teams enough context and control to respond when trust can no longer be justified.

Access Can Outlive Its Business Purpose

Leavers, role changes, dormant accounts and external collaborators can all leave unnecessary access behind. When permissions are granted quickly but not reviewed consistently, organisations lose clarity over which identities remain valid and why they have access.

Responders should not have to establish ownership and business purpose during an active incident. Effective identity governance addresses these questions in advance, which is why identity security is a business resilience issue, not merely a login requirement.

This is where a narrow focus on authentication can create false confidence. An organisation may have strong sign-in controls while still carrying years of accumulated access, unclear ownership and standing privilege. The authentication decision may be sound, but the environment behind it remains unnecessarily exposed.

A Stronger Identity Perimeter Supports Faster Containment

Organisations do not need to choose between MFA and broader identity security. MFA should form part of a layered strategy that reduces the risk of compromise and helps security teams investigate and contain incidents effectively.

The stronger position is built around five priorities. Together, they connect authentication with governance, privilege management and response rather than treating each as a separate security activity.

1. Proportionate Authentication

Authentication should provide meaningful protection without overwhelming employees with unnecessary prompts. The goal is to deliver reliable verification that reflects the sensitivity and context of each access request.

Higher-risk activity should receive stronger controls than routine access from an established context. This protects critical actions while reducing unnecessary friction, helping employees remain productive without weakening the organisation’s security position.

2. Context-Aware Access Decisions

Not every sign-in carries the same risk. Access decisions should consider the identity, device, requested resource and privilege involved.

This allows controls to respond proportionately rather than treating every request in the same way. It also helps security teams apply additional scrutiny where the potential business impact is greatest, rather than relying on one authentication standard for every scenario.

3. Least Privilege

Employees, administrators and non-human identities should have only the access required for their legitimate purpose. Restricting unnecessary permissions limits the reach of a compromised identity and reduces the number of systems that may need to be investigated.

Least privilege also gives responders a clearer view of what an account should be able to access. When expected access is well defined, activity outside that boundary becomes easier to identify and investigate.

4. Identity Lifecycle Governance

Every identity needs an owner, a clear purpose and a defined lifecycle. Governance should cover employees, guests, contractors, service accounts, application identities and automated systems.

Access needs to be reviewed and adjusted as roles, projects and business requirements change. When identity lifecycle governance works effectively, responders do not need to reconstruct basic ownership and access information under the pressure of an active incident.

5. Visibility & Response

Security teams need clear visibility of how identities are used and must be able to act quickly when risk changes. That visibility supports decisions such as restricting access, revoking sessions and investigating related activity.

Microsoft’s guidance on revoking user access in Microsoft Entra ID explains that administrators may need to block new sign-ins and revoke refresh tokens. It also cautions that the time between initiating revocation and access being removed depends on how applications grant access. 

Identity information delivers the most value when it is integrated with the organisation’s wider detection and response capability. Together, these controls turn identity into an active security boundary rather than a static list of accounts. They can reduce unnecessary exposure, improve investigation quality and support faster containment when an incident occurs.

For leaders considering this transition, understanding what Microsoft Entra means for the business provides further strategic context. Organisations seeking support with assessment, implementation and ongoing governance can also explore CyberOne’s Identity & Access Management services.

Do Not Wait for an Incident to Map Critical Access

One of the least helpful times to discover unclear identity ownership is during a live investigation. Yet this is exactly when gaps in ownership, privilege and business purpose become operationally significant.

Start by selecting one business-critical application and reviewing every human and non-human identity that can access it. For each identity, establish:

• Who owns it
• Why access is required
• Which privileges it holds
• Whether appropriate authentication and access policies apply
• When its access was last reviewed
• What should trigger its removal or reassessment
• How responders would restrict it during an incident

This focused exercise does not require a full redesign of the identity environment. It tests whether current governance can support an effective response and whether the organisation can make containment decisions using reliable information.

The review may reveal dormant accounts, excessive privileges or unclear ownership. More importantly, it allows these issues to be addressed proactively rather than under the pressure of an active incident.

The exercise should not be a one-off because identity environments change continuously. Employees move roles, suppliers are onboarded, applications are introduced and automated systems receive new permissions. Regular reviews help prevent legitimate access today from becoming unmanaged risk tomorrow.

MFA Is the Beginning of Identity Trust

MFA remains one of the most important controls an organisation can deploy, but enabling MFA is not the same as securing identity. From an incident response perspective, the real test comes after authentication: can the organisation determine what an identity accessed, identify its owner and privileges, then restrict its reach quickly without unnecessary disruption?

A resilient identity perimeter relies on proportionate privilege, context-aware access, lifecycle governance, monitoring and clear response capabilities. These controls do more than reduce the likelihood of compromise. They improve the organisation’s ability to understand an incident, limit its scope and maintain operational resilience while responding.

The practical next step is to select a critical application and review every identity with access to it. Confirm ownership, purpose, privileges and how access would be contained during an incident. This turns the article’s central argument into a concrete test of whether identity governance can support the organisation when its controls are under pressure.

If the review identifies unclear ownership, excessive permissions or inconsistent controls, contact a CyberOne expert for a 30-minute assessment.