Two-step sign-in
Microsoft or Google Authenticator for most people; passkeys or hardware tokens for admins, finance and similar prime targets. SMS codes are tolerated only as a short-term bridge.
Service · Cybersecurity
Access control and endpoint security
Work data used to stay behind the office door. Today Microsoft 365, Google Workspace and a dozen cloud tools open from any browser on earth, which suits criminals as much as staff. A password entered on a convincing fake page is all it takes for a stranger abroad to walk straight in. Imagine a Nova Gorica law practice of fifteen. Front-desk staff share a Windows profile, partners read files on private handsets, the managing partner's mailbox relies on a password alone, and no one could remotely disable a mislaid notebook. We swap that for rules built around three questions: who is this, which device are they on, and does the situation look normal? A colleague who confirms identity with a second step, on a company-managed device that is patched and encrypted, gets in smoothly. Anything else gets less access or an extra challenge. The tools are Conditional Access in Entra ID together with Intune or Google endpoint management, configured remotely and with care not to make everyday work tiresome.
Two-step sign-in
for every account, directors too
Conditional Access
decisions based on device, place and risk
Intune
or Google tools managing every work device
Own phones
with work data kept in a separate compartment
Scope of the service
Each layer adds protection by itself, so we stack them in an order that matches your risks and your team's appetite for change.
Access policies
In Entra ID: company data only from managed devices, extra checks for suspicious sign-ins, legacy authentication turned off, and sign-ins from places you have no business in rejected.
Managing devices
Work laptops and phones are enrolled in Intune, giving one place to enforce encryption, screen locking, update rings and remote wipe.
Bring your own phone
Mobile app policies confine company content to Outlook and Teams, stop it being copied into private ones and let us erase only work content when someone leaves.
Admin privileges
Everyday accounts lose local admin rights, admin tasks get separate identities, and LAPS gives every machine its own automatically rotated local admin password.
Allowed software
On especially sensitive machines, payroll or till terminals for instance, only approved programs may run. Elsewhere, at minimum, known dangerous tools are blocked.
How the work runs
Everybody in the company feels these changes, so the rollout is paced to avoid anyone losing a day's work.
01
Baseline
An overview of accounts, which lack two-step sign-in, which devices touch company data and which are unmanaged.
02
Enrolment and emergency access
Staff register using a short guide, with video help for anyone stuck. Two heavily guarded emergency logins ensure you always retain a way in.
03
Device onboarding
Company hardware is enrolled for remote management, policies are proven on a pilot group, and a quick guide covers personal phones.
04
Enforcing policies
Conditional Access first runs report-only. Once the impact is clear, enforcement is switched on in stages.
Knowing a password proves very little nowadays. Credential dumps and lookalike login pages are now so widespread that any account protected by a password alone should be considered a matter of time. Requiring a second step and a managed device stops the vast majority of these attempts before they get past the login page.
Your questions answered
Full device management is not necessary. Mobile app policies cover company content within Outlook and Teams only, with no view of pictures or personal conversations. A brief, honest explanation usually overcomes objections, and anyone still unhappy can be issued a company phone.
Individual logins work fine on shared machines. Quick account swapping and short lock timers keep the desk running, and you can tell who opened which client file, a useful safeguard from a GDPR standpoint as well.
Yes. Workspace offers its own equivalents for verification, context-aware access and device control, though the depth varies with your subscription, which we check at the start.
Tell us at once: helpme@apply.si if you have a contract, support@apply.si otherwise. An Intune-managed machine can be signed out, locked or erased within minutes. Encrypted disks keep the data safe in practice; an unencrypted one may need to be treated as a potential personal data breach.
More services in this area
Service
GDPR and data protection
Processing records, processor contracts, safeguards and a ready plan for when a breach happens
Service
Security policies and documentation
A policy, risk register and procedures that match daily reality
Service
Security tooling roll-out
Choosing, trialling and deploying protection remotely
Service
Infrastructure security
Perimeter clean-up, network zoning and controlled outside access
Make sure only the right people get in
Tell us how many people and devices you have, which suite you run and whether private phones are used. We will suggest a practical rollout sequence.
When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome
Video meetings, Teams and Meet both welcome
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
- Questions first. If something is missing before we can estimate, we email you or set up a brief video chat.
- A written quote. It spells out the work, a euro figure excluding VAT and a sensible start date. No fine print, no surprise line items down the road.
- You choose. It lands in your mailbox. Read it at your own pace, query anything that seems vague, and only then make up your mind.