--- title: "Essential Eight: Multi-Factor Authentication and Admin Privileges | StartCloud" url: https://startcloud.au/learn/essential-eight-access-controls description: "Module 4 of our free Essential Eight for Australian Business pathway: why SMS codes stop being enough as maturity rises, what phishing-resistant multi-factor authentication actually does, and why restricting administrative privileges decides how bad your worst day gets." lang: en --- Module 4 of StartCloud's Essential Eight for Australian Business learning pathway, in five short units with a knowledge check: multi-factor authentication and restricting administrative privileges explained for business owners, why ASD's Maturity Level Two attackers get around weak MFA with phishing and social engineering while Level Three attackers steal authentication token values to get around stronger methods, why phishing-resistant options such as passkeys and security keys behave differently, why admin accounts should never be used for email, and what evidence an insurer or assessor will ask to see. # Who gets in, and what they can do Module 4 · Access Unit 1 of 5 · about 2 min ## Two controls, one question Two of the eight controls deal with people rather than software. Multi-factor authentication, and restricting administrative privileges. They answer the two questions every attacker has to solve: **how do I get in, and once I am in, what can I do?** Patching, from the last module, is about closing holes in code. These two are about the front door and the keyring. Almost every serious incident we see in Perth businesses involves at least one of them, usually in the same order: a password gets stolen, the second factor was weak or missing, and the account that got taken over turned out to have far more power than anyone realised. Multi-factor authentication Proving it is really you with something beyond a password. It exists because passwords leak constantly, get reused across sites, and get typed into convincing fake login pages by sensible people on busy mornings. This is the control that keeps a stolen password from being enough. Restrict administrative privileges Making sure the accounts that can change everything are few, deliberate, and not used for everyday work. This is the control that decides whether one compromised login is an annoying afternoon or the end of your business as it currently exists. These two multiply each other Good multi-factor authentication on an account that can do anything is still a single point of failure. Tight admin controls on accounts with no second factor are a locked cabinet in an unlocked building. ASD lists them separately because they are different jobs, but in practice you cannot get much value from one without the other. StartCloud assistant Online G'day! 👋 I'm the StartCloud assistant. How can I help you today? ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Who Gets In, and What They Can Do", "description": "Module 4 of the Essential Eight for Australian Business pathway: multi-factor authentication and restricting administrative privileges, why weak MFA stops counting as maturity rises, and what proof an assessor wants.", "educationalLevel": "Beginner", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Essential Eight for Australian Business", "url": "https://startcloud.au/learn/essential-eight-for-australian-business", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-08-13", "dateModified": "2026-08-13", "url": "https://startcloud.au/learn/essential-eight-access-controls" } ] ```