Key takeaways
- Leftover subconsultant accounts are working logins into project data that nobody monitors, so contractor identity management starts with an inventory.
- Microsoft Entra B2B guests sign in with their own company's identity, so access ends when they leave that company.
- CIS Safeguard 5.3 calls for disabling dormant accounts after 45 days of inactivity.
- Microsoft recommends expiring external access packages and reviewing them quarterly or more often.
- NIST SP 800-171 requires protecting CUI systems during and after personnel actions such as terminations and transfers.
Contractor identity management is how your firm decides which outside people get a login, what each login can reach and when it ends. For an architecture, engineering or construction firm, one question shows whether it works: could a subconsultant from a project that closed last year still open your project site today?
Why are contractor and subconsultant accounts a risk for AEC firms?
They are a risk because they outlive the projects they were created for. A structural engineer, MEP consultant or freelance drafter gets an account or a guest invite for one project, the project closes, and the access stays. Each leftover account is a working login to your project sites, file shares or Teams channels that nobody is watching.
AEC firms work with more outside parties than most professional firms, and projects run for years. The patterns repeat: shared logins for a project mailbox, generic "drafter2" accounts handed from one freelancer to the next, and guests invited by whoever was project manager at the time. When a subconsultant's own mailbox is compromised, the attacker inherits whatever access you gave that person, and can reply inside real project threads. The FBI's business email compromise alert urges businesses to verify payment and account changes through a known contact, which matters more when outside accounts can see your invoices and pay applications.
Should outside collaborators get a firm account or a guest account?
In most cases a guest account is the better choice. With Microsoft Entra B2B collaboration, a subconsultant signs in with their own company's identity, so their employer manages the password, and when they leave that firm their sign-in stops working. A licensed firm account makes sense for long-term contract staff who work like employees: on your devices, in your systems, for months at a time.
Avoid shared and generic accounts entirely. CIS Safeguard 5.1 calls for an account inventory that includes "the person's name, username, start/stop dates, and department," and validation that "all active accounts are authorized" at least quarterly. A shared "consultant" login fails both tests, because nobody can say who used it on a given day.
How should you grant and remove subconsultant access?
Grant access through one documented process with an end date set on day one, and remove it through the same process. CIS Safeguards 6.1 and 6.2 call for a process, preferably automated, for granting access and another for revoking it.
In Microsoft 365, entitlement management access packages put that into practice. An access package bundles the project site, Team and any apps a subconsultant needs, and outside users request it through a portal. Microsoft recommends enforcing expiration on access packages for external users, using a fixed end date for project-based access, and keeping access to no longer than 365 days unless the project runs multiple years. When access ends, the guest account can be blocked from signing in or removed from the directory.
Package owners, usually the project manager, can be asked to confirm access on a schedule. Microsoft recommends quarterly or more frequent reviews for packages that include external users. If your licensing does not include entitlement management, the same principles work by hand: one request form, a named internal owner for every guest, an end date in the request and a monthly check of guests whose projects have closed.
What security should you require from outside users?
Require multifactor authentication for every outside user who can reach firm data. CIS Safeguard 6.3 requires MFA for "all externally-exposed enterprise or third-party applications," and Safeguard 6.4 requires it for remote network access.
Microsoft Entra cross-tenant access settings let you decide whether to accept MFA that a subconsultant already completed in their own company's tenant. By default, MFA and device claims from other organizations are not trusted. Trusting MFA from a long-standing partner avoids double prompts. For everyone else, your Conditional Access policy prompts them in your tenant. Either way, your MFA policy still applies. Configuring these trust settings requires Microsoft Entra ID P1 on your tenant.
Limit what each outside user can reach. Give access to the project folder, never the whole projects share, and keep guests out of accounting, HR and marketing libraries. If subconsultants need files on an on-premises server, zero trust network access can publish a single project share instead of a full network connection.
What changes for firms on defense work?
Firms that handle Controlled Unclassified Information under a DoD contract are held to NIST SP 800-171, and several of its requirements are identity requirements. DoD continues to assess against Revision 2 under a May 2024 class deviation.
Revision 2 requires firms to limit system access to authorized users (3.1.1), employ the principle of least privilege (3.1.5), use multifactor authentication for network access to non-privileged accounts (3.5.3), and protect systems containing CUI "during and after personnel actions such as terminations and transfers" (3.9.2). A subconsultant working inside your CUI environment needs the same discipline as an employee: a named account, MFA, access scoped to the project and removal the day they roll off.
If your firm is itself a subcontractor on defense work, expect the prime to ask about these controls. Our guide to CMMC flow down requirements explains how primes check subcontractors, and our SPRS score guide covers which NIST 800-171 gaps to close first.
What should AEC firms do about contractor access this quarter?
Start with an inventory of every outside account, then close the gaps it shows. Work through these steps in order:
- Export every guest and non-employee account from Microsoft Entra ID with its last sign-in date and the person who invited it.
- Disable accounts with no sign-in for 45 days, in line with CIS Safeguard 5.3, after a quick check with the owning project manager.
- Replace shared and generic accounts with named accounts or guests.
- Assign an internal owner to every remaining outside account.
- Require MFA for all guests through Conditional Access.
- Set an end date on every new subconsultant invite, tied to the project schedule.
- Schedule a quarterly guest access review. Microsoft Entra access reviews can block denied guests from signing in for 30 days and then remove them, with Entra ID P2 or Entra ID Governance licensing.
How can s90 help with contractor identity management?
s90's Identity Posture service gives AEC firms a regular view of every account that can reach firm data, including guests and contractors, with dormant accounts, missing MFA and overbroad access flagged for action. We set up the request, expiration and review workflow so project managers stay in control without chasing IT. If outside access has grown faster than anyone can track, we can start with an inventory.
