PAM for Small Businesses: Practical Privileged Access Without an Enterprise Vault

Small businesses hold the same dangerous keys as large ones, global admin accounts, local administrator passwords, MSP access and vendor app consents, but rarely the budget or staff for an enterprise privileged access management (PAM) vault. The good news is that most of the PAM outcomes that matter can be reached with tools a small business already pays for: a business password manager, Windows LAPS, the time-bound role features in Microsoft 365 and Google Workspace, and a firm agreement with the managed service provider (MSP). This guide shows how to assemble those pieces into a lightweight PAM programme for organisations of roughly 5 to 250 people. It assumes the basics in the Small Business Identity and Access Security Guide (separate admin accounts, MFA, few global admins) are under way and goes further. Platforms are listed alphabetically; order is not a ranking.

Key takeaways

• Start with an inventory, not a product. A one-page register of every privileged account, who holds it and where its credential lives is the foundation that any later tool depends on.
• Use what you already license. A business password manager, Windows LAPS and the built-in role controls in your cloud suite cover vaulting, rotation and time-bound access for most small firms.
• Make admin rights temporary. Google Workspace temporary role assignments and Microsoft Entra Privileged Identity Management (PIM) replace standing admin with access that expires.
• Treat the MSP as your biggest privileged user. Named technician accounts, least-privilege delegated roles, time limits and log access belong in the contract.
• Know when to graduate. Session recording, many servers, regulated data or dozens of admins are the signs that a dedicated PAM product is now worth its cost.

What PAM means at small business scale

An enterprise PAM platform bundles four jobs: discovering privileged accounts, vaulting their credentials, granting elevation on demand, and recording what admins do. A small business needs the same outcomes, sized to a handful of admins and a cloud-first estate. The Privileged Access Management Guide covers the full discipline; the table below shows the small business equivalent for each job.

Build the privileged account register

Most small business compromises abuse valid accounts rather than exploits: ATT&CK tracks this as Valid Accounts (T1078), with sub-techniques for Local Accounts (T1078.003) and Cloud Accounts (T1078.004). You cannot protect accounts you have not listed. Record at least these fields for each privileged account:

• Account and system: for example the Microsoft 365 or Google Workspace super admin, the domain registrar, DNS host, banking portal, accounting system admin, firewall or router, backup console, website hosting, and the MSP's remote monitoring and management (RMM) console.
• Owner and holders: one accountable owner and every person who can use it. Shared logins are recorded as shared, with a plan to split them.
• Credential location: which password manager vault holds it, or that it uses a security key held by a named person.
• MFA method: security key or passkey, authenticator app, SMS, or none. Any privileged account on SMS or none is a priority fix.
• Recovery path: how the account is recovered if the holder leaves, including recovery email and phone, and who else can reset it.
• Non-human accounts: API keys, service accounts and third-party apps with admin consent. The NHI for SMBs guide covers these in depth.

Review the register every quarter and whenever someone with admin access joins, changes role or leaves.

Vault credentials in a business password manager

For most small businesses a business-tier password manager is the PAM vault. It will not do enterprise check-out workflows, but configured carefully it gives controlled sharing, an audit trail and safe offboarding. See the Password Manager vs PAM guide for where the boundary sits.

1. Create a restricted admin vault: a separate shared vault or collection for privileged credentials, shared only with the two or three people who need it, never with the whole company.
2. Split by sensitivity: keep break-glass and banking credentials in their own vault with the smallest membership; keep day-to-day admin logins in another.
3. Protect the vault itself: require phishing-resistant MFA (security keys or passkeys) for vault members, and enable the account recovery option your product offers so a departing admin does not take the vault with them.
4. Turn on event logging: use the admin console's event or activity log to see who viewed, copied or changed privileged entries, and export it to wherever you review alerts.
5. Rotate on change: change every credential a leaver could see on the day they leave, starting with registrar, email tenant and banking.
6. Avoid storing what can be removed: where an admin account can use a passkey or security key instead of a password, prefer that, so there is no reusable secret to steal.

Product selection criteria are in the Password Manager Buyer's Guide.

Rotate local admin passwords with Windows LAPS

A single local administrator password reused across every laptop lets an attacker move from one device to all of them, for example with Pass the Hash (T1550.002). Windows LAPS solves this at no cost: it regularly rotates each device's local administrator password and backs it up to Microsoft Entra ID (for Entra-joined and hybrid-joined devices) or to Windows Server Active Directory, but not to both. Backing up to Entra ID needs Microsoft Entra ID Free or higher, and AD backup needs no extra licence.

• Supported devices: Windows 11 23H2 and later natively, and Windows 10, Windows 11 22H2 and 21H2, and Windows Server 2019 and 2022 with the April 11, 2023 update or later. Windows 10 is covered only while it still receives updates, for example through Extended Security Updates.
• Deployment: cloud-managed small businesses configure it through the Windows LAPS CSP in Intune; on-premises domains use the Windows LAPS Group Policy.
• Retire legacy LAPS: legacy Microsoft LAPS is deprecated on Windows 11 23H2 and later, and its installer is blocked on newer versions. The Legacy LAPS vs Windows LAPS guide covers migration.
• Newer options: Automatic Account Management settings in the CSP need Windows 11 24H2 or later, or Windows Server 2025 or later.
• Who can read passwords: restrict password retrieval to the admin group, and review the retrieval log in Entra ID or the LAPS event log channel.

For non-Windows devices, keep local admin credentials unique per device in the password manager vault, or remove local admin and manage the device through your device management tool. The LAPS vs PAM Vaulting guide compares the approaches.

Just-in-time admin with built-in cloud features

Standing admin rights mean a phished admin session is always a full compromise. Both major small business suites now offer ways to make admin access expire.

Google Workspace

Google advises more than one super admin, each a separate person with no sharing, two accounts per super admin (a dedicated admin account and an everyday account), security keys for 2-Step Verification, a spare key and printed backup codes, and limited admin roles for routine tasks. Since 23 September 2026 Google Workspace lets admins assign admin roles to users, groups or service accounts for a set period, either a preset duration such as 30 days or a custom expiry date and time, after which the access is revoked automatically. Temporary roles cannot be assigned to the primary admin, who keeps permanent super admin rights.

• Use it for: project work, cover during absence, auditor access and MSP technicians who need a role for a fixed engagement.
• Pair it with: narrow prebuilt or custom roles (for example user management without user deletion) rather than temporary super admin.
• Availability: Google lists the temporary role feature as available to all Google Workspace customers, announced 23 September 2026.

See Google Workspace for Small Business for wider tenant settings.

Microsoft 365

Microsoft Entra Privileged Identity Management makes roles eligible rather than permanently assigned. A user activates a role when needed, for a limited time, with MFA on activation, a written justification and, optionally, approval; PIM sends notifications on activation, supports access reviews and keeps an audit history. It also prevents removal of the last active Global Administrator and Privileged Role Administrator assignments.

• Use it for: Global Administrator, Exchange Administrator, SharePoint Administrator and other high-impact roles held by internal staff.
• Pair it with: narrower roles such as User Administrator and Helpdesk Administrator for routine work. See the Entra ID Privileged Roles Guide and the Privileged Identity Management (PIM) Guide.
• Availability: Microsoft states that PIM requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licences; it is also included in Microsoft Entra Suite and Microsoft 365 E7. Microsoft Entra ID P1 does not include it. Check Microsoft's licensing guidance for how many licences you need.

See Microsoft 365 Business Premium for wider tenant settings.

Emergency access in either suite

Time-bound access must not lock you out. Microsoft recommends two or more cloud-only emergency access accounts on the onmicrosoft.com domain, with permanent (not eligible) Global Administrator, passkey (FIDO2) sign-in using different methods from other admins, exclusion from blocking Conditional Access policies through a dedicated group, an alert on every use, and validation at least every 90 days. Google's guidance to keep more than one super admin, a spare security key and printed backup codes in a secure location serves the same purpose. The Break-Glass Account Guide has the full procedure.

Govern MSP and vendor privileged access

An MSP with tenant-wide admin and an RMM agent on every device is the most privileged identity a small business has. Attackers use this route deliberately: ATT&CK lists Trusted Relationship (T1199) and Remote Access Tools (T1219). Third-party apps carry the same risk: in the ConnectWise Cloud Backup breach 2026, a stolen secret for a multi-tenant backup app let an attacker sign in to customer Microsoft 365 tenants as the app, and in some tenants related service principals granted themselves directory roles. The customer-side lesson is to scope and monitor every admin consent you give a vendor.

The GDAP and MSP Delegated Admin Access Guide covers delegated roles in detail, and Choosing an IT Support Provider or MSP Securely covers selection and contracts.

Decision guidance: when built-in tools are enough

If you choose to buy, look for a product sized and priced for small teams, and confirm that it covers your cloud tenants, not only Windows servers. The Credential Vaulting vs Just-in-Time Elevation guide explains the two main product models.

A 90-day rollout

1. Days 1 to 15, inventory: build the privileged account register, export the admin role lists from your cloud suite and your MSP's partner relationships, and fix any privileged account without MFA.
2. Days 15 to 30, vault: create the restricted admin and break-glass vaults, move credentials in, rotate anything previously shared by email or chat, and set up emergency access accounts.
3. Days 30 to 60, rotation: deploy Windows LAPS to a pilot group of a few devices, confirm passwords back up and can be retrieved by the right people, then extend to all Windows devices and retire legacy LAPS.
4. Days 45 to 75, time-bound access: convert standing admin roles to temporary assignments (Google Workspace) or eligible PIM roles (Microsoft 365), starting with one admin, then the rest. Keep emergency accounts permanent.
5. Days 60 to 90, MSP: agree the controls in the MSP table, remove legacy or excess delegated access, and confirm you can read the admin audit logs.
6. Rollback: if time-bound access blocks urgent work, use the emergency account and fix the role settings rather than returning to permanent admin; if LAPS breaks support access, retrieve the current password from the backup rather than disabling rotation.

Detection and measurement

• Alert on: use of any emergency access account, new admin role assignments, new partner or delegated relationships, admin consent to new third-party apps, and new remote access software on devices.
• Review monthly: admin role reports, password manager event logs for the admin vault, and LAPS password retrievals.
• Metric, standing admins: number of accounts with permanent admin roles, excluding emergency accounts (target: as close to zero as practical).
• Metric, MFA strength: percentage of privileged accounts using security keys or passkeys (target 100 percent).
• Metric, LAPS coverage: percentage of Windows devices with a LAPS password backed up in the last rotation period.
• Metric, MSP scope: number of MSP roles beyond those listed in the contract (target zero).
• Metric, register freshness: days since the last privileged account register review (target under 90).

Common failure patterns

• The owner's account is the admin account: the founder's everyday mailbox holds Global Administrator or super admin, so one phishing email compromises the whole tenant.
• Vault shared with everyone: privileged credentials sit in a company-wide shared folder in the password manager, defeating the point of vaulting.
• Time-bound access without a way back: all admins are made temporary and no emergency account exists, so an expiry or MFA problem locks the business out.
• MSP access never reviewed: broad delegated rights granted at onboarding remain years later, including for technicians who have left the MSP.
• Vendor app consents forgotten: backup, email security or reporting apps hold admin-level permissions nobody monitors, as the ConnectWise Cloud Backup case shows.
• Same local admin password everywhere: a laptop image ships with one local admin password that is never rotated.

Framework mapping

In the UK, Cyber Essentials lists user access control as one of its five technical controls, and the steps in this guide support that requirement.

Practitioner checklist

• Build and review quarterly a privileged account register covering cloud, finance, domain, network, backup and MSP tools.
• Move privileged credentials into a restricted admin vault in a business password manager with event logging on.
• Require security keys or passkeys on every privileged account and on the vault itself.
• Deploy Windows LAPS through Intune or Group Policy and retire legacy LAPS.
• Replace standing admin with Google Workspace temporary roles or Microsoft Entra PIM eligible roles.
• Keep at least two tested emergency access accounts, alerting on every use.
• Put named accounts, least-privilege delegated roles, time limits and log access for the MSP in the contract.
• Review admin consents granted to third-party apps every quarter.
• Track standing admins, MFA strength, LAPS coverage and MSP scope as monthly metrics.

Standards and references

• Microsoft Learn: What is Windows LAPS?
• Google Workspace Admin Help: Security best practices for administrator accounts
• Google Workspace Updates: Assign temporary administrator roles in the Google Admin console
• Microsoft Learn: What is Microsoft Entra Privileged Identity Management?
• Microsoft Learn: Microsoft Entra ID Governance licensing fundamentals
• Microsoft Learn: Manage emergency access admin accounts
• Microsoft Learn: Introduction to granular delegated admin privileges (GDAP)
• NCSC: Cyber Essentials overview

Related NHI Mgmt Group resources: Small Business Identity and Access Security Guide · Privileged Access Management Guide · NHI for SMBs · Choosing an IT Support Provider or MSP Securely