In short: Identity and access software verifies users with multi-factor authentication, gives them single sign-on to their applications, and controls privileged access such as local admin rights and server credentials. Products are mostly licensed per user, with privileged access sometimes per admin or per device. MFA on cloud services is expected by Cyber Essentials and most cyber insurers.
What identity and access software covers
Most breaches involve a stolen or misused identity. Identity and access software tackles this in three ways:
- Multi-factor authentication (MFA): a second check, such as a push approval, passkey or security key, on top of the password. Phishing-resistant methods such as FIDO2 passkeys are now the recommended standard.
- Single sign-on (SSO): users sign in once and reach their cloud apps through a single identity provider, with consistent MFA and policies, and a single place to remove access when someone leaves.
- Privileged access management (PAM): control over the powerful accounts and rights that attackers want, including removing local admin rights from users, approving elevation for specific tasks, vaulting server and service credentials and recording admin sessions.
Related tools add identity threat detection and response (ITDR), which looks for signs of account takeover across Microsoft Entra ID, Google and other identity sources.
The Cyber Essentials requirements expect MFA on cloud services wherever it is available, and cyber insurers routinely ask about MFA for email, remote access and admin accounts.
Identity, MFA and privileged access: vendors and products we supply
- 1Password: Encrypted business password manager, billed monthly per user with no minimum.
- 1Password Business: Shared vaults, SSO unlock, provisioning and reporting, licensed per user.
- Blackpoint Cyber: CompassOne platform with 24/7 endpoint MDR and identity ITDR from a human-led SOC.
- Blackpoint Cyber ITDR: 24/7 identity detection and response for Microsoft 365, Google Workspace and Cisco Duo.
- CrowdStrike: Falcon endpoint protection, managed threat hunting, Falcon Complete MDR, identity, SIEM and AI security.
- CrowdStrike Identity Threat Protection: ITDR for Active Directory and cloud identity, with risk-based MFA and a managed option.
- CyberFOX: AutoElevate privileged access management: remove admin rights without slowing people down.
- CyberFOX AutoElevate: Remove local admin rights, with rule and mobile app approvals and attack tool blocking.
- Cynet: One-agent security platform with EDR, XDR, deception and 24x7 CyOps MDR, licensed per endpoint.
- Cynet All-in-One platform: Protect, Elite and All-in-One packages compared, licensed per endpoint.
- Dropsuite Entra ID backup: Point-in-time backup of Entra ID users, groups, roles and policies.
- Exium: SASE, software firewall, XDR and identity on one platform, licensed per user.
- Exium IAM360: SSO, MFA, passwordless sign-in and a password manager, per user.
- Google: Google Workspace editions, Cloud Identity, Cameyo and Google Cloud on one account.
- Google Cloud Identity Premium: Google SSO, MFA and device management, with or without Workspace.
- Guardz: Managed identity, email, endpoint and awareness security for small businesses, with 24/7 MDR.
- Guardz Managed security plans: Pro, Ultimate and Elite plans compared, run for you and licensed per user.
- Guardz MDR: 24/7 detection and response for endpoints and identities, on Ultimate and Elite.
- Keeper Security: Zero-knowledge business password manager and KeeperPAM privileged access, licensed per user.
- Keeper Security Connection Manager: Self-hosted, browser-based RDP, SSH and VNC access with session recording.
- Keeper Security Endpoint Privilege Manager: Remove local admin rights with just-in-time elevation on Windows, macOS and Linux.
- Keeper Security KeeperPAM: Privileged sessions, rotation, recording and discovery, licensed per admin user.
- Keeper Security Secrets Manager: Machine and DevOps secrets out of code and into the vault, with SDKs and CI/CD integrations.
- Keepit Entra ID backup: Backup for Entra ID objects, Conditional Access and Intune policies.
- Keepit Okta backup: Backup and recovery for Okta users, apps, groups and policies.
- LastPass: Business password manager with shared folders, central policies and an MFA add-on.
- LastPass MFA: MFA and passwordless sign-in for apps, VPNs and workstations, added to LastPass Business.
- Netwrix: 1Secure data and identity security, Netwrix Auditor and PingCastle AD assessments.
- Netwrix 1Secure: SaaS data security posture management, identity risk and auditing, per user.
- Netwrix Auditor: On-premises change and access auditing with compliance reports.
- Netwrix PingCastle: Active Directory security assessments, risk scores and remediation guidance.
- SentinelOne: Singularity endpoint, cloud and identity security with Purple AI and managed detection and response.
- SentinelOne Singularity Identity: Identity posture, ITDR and deception for Active Directory, Entra ID and Okta.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos ITDR: Identity posture checks, dark web credential monitoring and response, added to XDR or MDR.
- ThreatDown: Malwarebytes business security: endpoint protection, EDR, MDR, patching and more, billed monthly.
- ThreatDown ITDR: Detect and stop identity attacks on Active Directory, Entra ID and Okta, per user.
- Todyl MXDR: 24/7 managed detection and response across endpoints, network and identities.
- TruGrid: Zero trust remote desktop access and BitLocker management for Windows.
- TruGrid SecureRDP: Zero trust RDP to PCs, RDS and virtual desktops with MFA and no open ports.
- WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
- WatchGuard AuthPoint: Per-user MFA with push, QR code, OTP and passkeys for VPN, RDP and cloud apps.
- WatchGuard CloudDR: Identity threats, misconfigurations and shadow AI across SaaS apps, per identity.
- Zero Networks: Agentless microsegmentation, identity segmentation and secure remote access.
- Zero Networks Identity Segmentation: Restrict admin and service account logons, per server or workstation.
What to look for
- Authentication methods: push with number matching, passkeys, platform authenticators (Windows Hello, Touch ID), hardware security keys and an option for staff without smartphones
- Coverage: cloud apps, VPNs, Windows and macOS logon, remote desktop and on-premises systems
- Device trust: checking the device is managed and up to date before allowing access
- For PAM: just-in-time elevation, approval workflows (ideally from a mobile app), audit trails and minimal user disruption
- Integration with Microsoft Entra ID or Google Workspace as your directory
Pay attention to recovery too. Users lose phones and change devices, and a clumsy re-enrolment process quickly turns into helpdesk tickets or, worse, weaker exceptions to policy. Self-service enrolment, backup methods and a clear process for verifying someone's identity before resetting their MFA all matter.
How identity software is licensed
MFA and SSO products are licensed per user, typically in editions that add features such as device trust, risk-based authentication and ITDR at higher tiers. Privileged access tools vary: endpoint privilege tools such as CyberFOX AutoElevate are often per device, while credential vaulting and session management, such as Keeper's privileged access options, may be per admin user or by add-on. Hardware security keys are bought separately. Our Cisco Duo pricing guide shows how one vendor structures its editions.
How to choose
- Start with MFA on email, remote access and admin accounts if you have not already.
- Decide whether you need a separate identity provider or will extend Microsoft Entra ID or Google Workspace.
- Remove standing local admin rights and put an elevation tool in place for the tasks that genuinely need it.
- Plan for users without smartphones and for shared workstations.
- Move towards phishing-resistant methods over time.
See our specialist Cisco Duo site for MFA, SSO and device trust in depth, and business password managers for credential storage.
How we help
We supply identity, MFA and PAM licences on one account, help you choose editions, and plan the roll-out so users are enrolled smoothly and nobody is locked out. Contact us and ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between MFA and SSO?
MFA adds a second check to a login. SSO lets users sign in once and reach many applications. Used together, users get one strong login protected by MFA for all their apps.
Does Cyber Essentials require MFA?
Yes. The Cyber Essentials requirements expect MFA on cloud services wherever the service offers it, for all users. Check the current requirements for details.
Why remove local admin rights?
Admin rights let malware and attackers install software, disable security tools and move across a network. Removing them, with a controlled way to elevate when needed, closes one of the most common attack routes.