Protect recovery as carefully as login
An administrator can use MFA and still leave the business exposed if recovery codes are lost or a former contractor controls the recovery email. We review the whole access path, including service accounts that cannot use an interactive login. Prefer phishing-resistant methods where supported, and verify that the business can recover access before removing an existing method.
Review privileges and recovery together
Inventory registrar, DNS, hosting, CMS, email and business tools. MFA protects authentication while roles determine permissions. Recovery methods and unmanaged sessions can undermine otherwise strong sign-in controls.
- List owners, administrators and delegated accounts.
- Review supported MFA and recovery.
- Reduce obsolete access with authorization.
- Verify the remaining owner path.
Owner, contractor and service-account checks
Do not send recovery codes in a form or rotate secrets without identifying consumers. Phishing-resistant methods depend on platform support. The handover records approved roles, changes and exceptions without exposing authentication material.
| Account | Check | Boundary |
|---|---|---|
| Owner | Named control and recovery | No unapproved ownership transfer |
| Contractor | Role, expiry and removal | Shared credentials obscure actions |
| Service | Purpose and credential consumers | Coordinate rotation |
Example: remove a departing contractor safely
After a contractor leaves, CMS removal alone does not address registrar access, tokens or sessions. Verify ownership before revoking paths that the business may still need. This is an illustrative scenario, not a customer case or a promised result.