Securing small business cloud accounts: email, accounting, files and your domain

To secure business cloud accounts, small businesses usually focus on a few things: multi-factor authentication (MFA), careful use of admin accounts, up-to-date recovery details, keeping control of the domain name, and removing access when people leave. This guide explains each one for the accounts most small businesses depend on: email, accounting, file sharing, and the website and domain registrar. It draws on the Australian Signals Directorate’s (ASD) small business guide, Microsoft’s documentation and auDA. It’s general education, not an audit; each provider’s own help pages have the current steps.

Why it matters

For many small businesses, the most valuable systems aren’t on a computer in the office. They’re cloud accounts. ASD’s MFA guide lists email first among accounts to protect, because access to email can let an attacker reset passwords for other accounts. A taken-over email account can also be used to send fake invoices to customers (see business email compromise).

ASD’s small business guide suggests “using online or cloud services that offer built-in security, instead of managing your own”. Those services still depend on how the business sets up and manages its accounts.

Start with a list of accounts

Before changing settings, it helps to know what exists. A simple list records, for each service:

• what it is (email, accounting, file sharing, website hosting, domain registrar, payments, social media)
• who the admin or owner is
• who else has access, including outside providers
• whether MFA is on
• where the recovery email and phone number point.

The supplier and IT provider security guide covers accounts that providers manage for the business.

How to set up MFA on business accounts

ASD’s small business guide describes turning on MFA “wherever possible, starting with your most important accounts”, and calls it “one of the most effective ways to protect your accounts”. Based on ASD’s MFA guide (checked October 2026), the general approach is:

1. Start with email and admin accounts, then accounting and banking, then file sharing, the domain registrar and social media. ASD’s guide lists email and user accounts, financial services, and accounts that store payment details among its priorities.
2. Choose the method. ASD’s MFA guide notes that authenticator apps are more secure than SMS codes, and describes security keys as “a more secure form of MFA than the other options above”. See MFA methods compared and hardware security keys.
3. Turn it on in each service’s security settings. The exact steps differ by provider; each provider’s help pages explain them.
4. Save the recovery codes. ASD’s MFA guide recommends “adding a recovery method to your account and saving your backup codes in case you lose access to your authenticator app”.

For Microsoft 365, Microsoft’s documentation says that “because security defaults is on by default, multifactor authentication (MFA) is enabled by default in Microsoft 365 for business organizations”. The security defaults vs Conditional Access guide explains the options.

How to limit and protect admin accounts

Admin accounts can change settings for everyone, so they’re the most valuable accounts to an attacker.

• ASD’s small business guide describes making sure “each user can access only what they need for their role”, and securing administrative accounts “with a strong passphrase or multi-factor authentication”.
• ASD’s Essential Eight describes privileged users having “a dedicated privileged user account to be used solely for duties requiring privileged access” (see the Essential Eight explained). In practice, that means the owner might use one account for everyday email and a separate one for admin tasks.
• For Microsoft Entra (which runs Microsoft 365 sign-in), Microsoft recommends assigning the Global Administrator role “to fewer than five people”, and having “two cloud-only emergency access accounts” for situations where normal admin accounts can’t be used.
• Microsoft also describes regularly reviewing admin roles because people “can amass unnecessary access over time”.

Shared accounts

ASD’s guide describes limiting “the use of shared accounts” and securing any that are used. Shared logins make it hard to tell who did what and hard to remove one person’s access. Where a shared login can’t be avoided, ASD’s guide describes securing it. Some businesses use a password manager’s sharing features so the password isn’t kept in emails or notes (see password managers).

How to check recovery details

Recovery details decide who can get back into an account. ASIC’s guidance for scammed businesses lists reviewing and updating account recovery details. Things businesses commonly check:

• the recovery email address isn’t a former employee’s personal address
• the recovery phone number belongs to someone still in the business
• recovery codes are stored somewhere safe and known to more than one trusted person.

ASD’s MFA guide also says recovery email addresses should be kept as secure as primary ones. The account recovery plan guide explains recovery options in more detail.

How to keep control of your domain name

The domain name (for example, mybusiness.example) controls the business’s website and, usually, its email. If it lapses or is transferred away, both can stop working.

Renewal dates and contact details

auDA, which administers .au domain names, describes understanding “how to renew your .au domain name licence and the risks of not doing so before your licence expiry date”, and keeping “your contact details up to date”. auDA’s renewal fact sheet explains:

• A licence period is one to five years, and it can be renewed “up to 90 days prior to the licence expiry date”.
• The provider sends reminder emails as expiry approaches, so contact details need to be current to receive them.
• After expiry there is a “30 calendar day grace period”, during which the domain can’t be used or updated, so the website and email stop working.
• If it still isn’t renewed, “your domain name will be removed from the registry at the end of the 30 days”, and anyone can then register it.

Fake renewal invoices

NT Consumer Affairs’ page on false billing scams covers domain name renewal and warns that “scammers might try to impersonate these businesses or provide fake bank account details for payment”. It describes keeping business records so the business “can easily check which company manages your domain name”, checking that any renewal request is from “the company you initially registered with”, and confirming any change of bank details using the contact details on the provider’s own website.

Checking who controls the registrar account

If a web designer or IT provider registered the domain in their own account, the business may not control it. A common check is that the business itself is the registrant and has its own login, with MFA where the provider supports it.

How to remove access when someone leaves

ASD’s small business guide notes that “unless you change the password, employees could also continue accessing accounts even after they have left the business”. A short offboarding routine, done on the person’s last day, commonly covers:

1. Disabling or removing their accounts in email, accounting, file sharing and other services.
2. Changing shared passwords they knew, including Wi-Fi and any shared logins.
3. Removing them as an admin and from recovery email or phone settings.
4. Transferring ownership of files, mailboxes or shared folders they owned.
5. Collecting business devices and removing business data from personal devices where relevant.

For Microsoft 365, see staff offboarding in Microsoft 365. The same routine applies when an outside provider’s work ends.

Things to watch for

• One person holds every key. If only one owner or one provider can sign in to email admin or the domain registrar, the business is exposed if that person is unavailable. Microsoft’s emergency access guidance is built around avoiding being “locked out”.
• Recovery details pointing to people who’ve left.
• Admin accounts used for everyday email and browsing.
• Domain renewal emails going to an old address, or renewal-style invoices from a company the business didn’t register with.
• Sign-in alerts ignored. ASIC’s guidance describes checking login activity for unusual devices, times or locations.
• Old accounts and trials. Unused services can still hold business data.

Common questions

How do I secure my business cloud accounts?

Small businesses usually focus on five things: multi-factor authentication (MFA), careful use of admin accounts, up-to-date recovery details, keeping control of the domain name, and removing access when people leave. ASD’s small business guide describes turning on MFA “wherever possible, starting with your most important accounts”. A simple list of accounts, admins and recovery details is a common first step; see start with a list of accounts.

How do I secure my business email account?

ASD’s guidance starts with MFA, listing email first because access to it can be used to reset other passwords. ASD’s MFA guide notes that authenticator apps are more secure than SMS codes, and describes saving backup codes. ASD’s small business guide also describes unique passwords or passphrases and limiting admin access. Each provider’s help pages have the exact steps; see how to set up MFA on business accounts.

How many admin accounts does a small business need?

It depends on the service. For Microsoft Entra, which runs Microsoft 365 sign-in, Microsoft recommends assigning the Global Administrator role “to fewer than five people” and having “two cloud-only emergency access accounts”. ASD’s guide describes giving each user only the access their role needs, and ASD’s Essential Eight describes a dedicated account for admin duties. See how to limit and protect admin accounts.

What happens if my .au domain name expires?

auDA’s renewal fact sheet describes a “30 calendar day grace period” after expiry, during which the domain can’t be used or updated, so the website and email stop working. If it still isn’t renewed, auDA says the domain is removed from the registry and anyone can then register it. A licence can be renewed up to 90 days before expiry. See renewal dates and contact details.

How can I tell if a domain renewal invoice is a scam?

NT Consumer Affairs warns that “scammers might try to impersonate these businesses or provide fake bank account details for payment”. It describes keeping records of which company manages the domain, checking that a renewal request is from “the company you initially registered with”, and confirming any bank detail change using the contact details on the provider’s own website. See fake renewal invoices.

What do I do when an employee leaves?

ASD’s small business guide notes that “unless you change the password, employees could also continue accessing accounts even after they have left the business”. A short offboarding routine on the person’s last day commonly covers disabling their accounts, changing shared passwords, removing admin and recovery details, transferring file ownership and collecting business devices. See how to remove access when someone leaves.

Where to get official help

• ASD’s small business cyber security guide
• ASD’s multi-factor authentication guide
• Microsoft 365 for business security overview
• auDA: manage your .au domain name
• If an account has already been taken over, see what to do if an account is hacked.