MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: access reviews

  • Everyone Is an Admin: A Twenty-Minute Permissions Audit

    Everyone Is an Admin: A Twenty-Minute Permissions Audit

    A new small-group leader gets her login on a Wednesday. She’s a volunteer, she’s delightful, and she needs to see who’s in her group and email them about Thursday.

    She signs in, clicks around to find her group, and lands on a member profile. And there it is: a home address, a spouse’s phone number, the names and ages of two children, a note from three years ago about a hospital visit, and a giving history going back to 2019 with every amount.

    She didn’t go looking. It was simply on the screen, because when the church set the system up in a hurry, the fastest way to make sure nobody got stuck was to give everybody the top level of access.

    That’s how it happens in nearly every church. Not carelessness — expedience, under time pressure, years ago, by someone who has since moved on.

    This is not about trust. It’s about blast radius

    Say this out loud at your next staff meeting, because it disarms the whole conversation before it becomes awkward:

    We are not doing this because we don’t trust anyone. We’re doing it so that one stolen password doesn’t expose everything.

    Blast radius is a plain idea wearing a dramatic name. It means: when one account is compromised, how much does the attacker get? If every account is a full administrator, the answer is all of it — every address, every giving record, every note — no matter which of the twenty accounts they happened to catch.

    And accounts do get caught. Phishing — the fake email that leads to a convincing but counterfeit login page — was the most-reported crime type in the FBI’s 2025 figures, with 191,561 complaints. It doesn’t select for the senior pastor. It catches whoever clicks, and in a church that is statistically going to be a volunteer with an old password and no second step at login.

    The goal isn’t to make anyone prove they deserve access. It’s to make sure that the volunteer who runs the coffee rota, if phished on a Tuesday, costs you the coffee rota.

    The data that shouldn’t all travel together

    Your church management system holds the most sensitive information your organization has anywhere. Not the bank account — this. Four categories deserve to be separated from general access:

    Giving amounts. Who gave what, and when. In many congregations this is the single most closely-held fact about a person, and knowing it changes how people are treated. Very few staff need it, and the ones who do are usually the treasurer, the bookkeeper, and the senior pastor — and some churches deliberately exclude the pastor. Whatever your practice, it should be a decision, not an accident of software setup.

    Children’s records. Names, ages, guardians, pickup authorizations, allergies, sometimes photographs. This should be visible to children’s ministry leadership and to no one else. There are also legal dimensions here — background check records, retention obligations, and what you may keep about a minor — and those requirements vary by state. Ask a lawyer about your own; don’t take a blog’s word for it, including this one.

    Pastoral notes. Counselling records, hospital visits, crisis notes, prayer requests that were shared in confidence. If your system lets staff write private notes on a person’s profile, find out right now who can read them. In a great many churches the answer is “anyone with a login,” and the people writing those notes have no idea.

    Contact details and addresses. Lower-sensitivity, but not zero — for someone in a domestic violence situation, an address in a widely-accessible directory is a genuine safety issue. Some systems support a confidential or restricted flag on individual records. Find out whether yours does.

    Systems differ in how finely they slice this, but the principle doesn’t: these four should be four separate decisions, not one.

    The question to ask about each person

    Not do we trust them? Everyone will say yes and the meeting will end.

    Not might they ever need this? That question always answers yes, and it’s how you got here.

    The question is: what does this person need to do their job this month?

    The month framing does the work. It converts a hypothetical into a concrete recollection. The office administrator needs to add new households and update phone numbers — this month. The children’s director needs check-in and guardian records — this month. The small-group leader needs the roster and email for her group — this month. The treasurer needs contribution records — this month.

    Nobody needs all four categories to do anything this month. When somebody does need something extra — pulling year-end statements, running a report for the board — grant it, do the task, and take it back. Temporary access is normal in every other part of church life. You give someone a key to the building for a season and then you ask for it back, and nobody takes offence.

    The twenty-minute routine

    Do this once now, then twice a year. Set a timer; the constraint is what makes it repeatable.

    Export the user list. Most platforms will let you export or print the list of people who have logins and what level each one holds; if yours won’t, a screenshot or a typed-up copy does the job. Get it onto one page where you can see all of it at once. This step alone is usually the shock — churches routinely find far more active accounts than anyone in the room expected.

    Group people by what they actually do. Not by their title. Sort the list into rough buckets: office and administration, finance, children and youth, pastoral, group leaders, and a bucket for anyone you can’t place. Four or five roles covers almost every church.

    Find the accounts nobody recognizes. There will be some. The consultant who did your setup. An email address at a domain the church no longer uses. A name three people vaguely remember. A generic login called “office” or “admin” whose password is known to an unknown number of people. Deal with these first — they’re the highest-risk items on the page and the easiest to close, because nobody will miss them.

    Downgrade before you delete. This is the step that keeps the whole exercise from going wrong. Deleting a user in a church database can orphan the records they created, break reports, or remove notes someone else relies on. So drop people to the lowest level that matches their bucket, and leave the account in place. Watch for a month. If someone genuinely can’t do their job, you’ll hear about it in a day and you can restore it in thirty seconds. Then delete what’s still unused. Downgrading is reversible and quiet; deleting is neither.

    Write down the roles and set the next review. One paragraph in a shared document: here are our five roles, here’s what each can see, here’s who decides. Then put a recurring appointment in the calendar — twice a year is plenty, and pairing it with something you already do, like the annual meeting or the start of the program year, means it actually happens.

    The doors nobody audits

    Two categories sit outside the user list entirely, which is exactly why they get missed.

    Integrations and API keys. An API key is a long string of characters that lets one piece of software log into another without a human being present. Your giving platform talks to your church database. Your website’s event form pushes registrations in. A texting service reads your contact list. A volunteer’s clever spreadsheet syncs attendance. Every one of those connections holds standing access, often at a high level, and it does not appear in the staff list you just reviewed.

    Find the integrations or connected-apps section of your system and read it with the same question: do we still use this, and does it still need that much? Pay particular attention to anything created by someone who has left, and to keys generated by a volunteer for a project that finished. Those keys don’t expire because a person moved away. Revoke and regenerate anything you can’t account for.

    Volunteers on personal phones. Most of your group leaders and children’s workers access the system on a phone that is also used by their spouse, their teenager, and occasionally the family iPad. That phone may have no lock code. It stays signed in indefinitely. If it’s lost at a football game, a member of your congregation’s home address is in a stranger’s hand.

    You cannot manage those devices, and you shouldn’t try. What you can do is ask three things of anyone with a login: use a lock screen, turn on the extra step at sign-in if your platform offers it, and tell the office immediately if the phone is lost so the account can be signed out. Then find out now — not on the day it matters — whether your system can sign a user out of every device at once or force a password reset, and where that control lives.

    The same shape, whatever platform you’re on

    Churches run on Planning Center, Breeze, Tithely, Church Community Builder (now branded Pushpay ChMS), Realm, and a dozen others. Each names things differently, and the names change; the underlying concepts don’t, which is why this article describes them rather than giving you a menu path that would be wrong by next spring.

    Look for: a list of users and their permission level; named roles or permission groups you can define once and reuse; separate toggles for financial and giving data; separate handling for children’s and check-in records; a restriction on who can read private or pastoral notes; a way to mark an individual record confidential; and a connected-apps or API section. Not every platform has all of these. If yours is missing one — particularly the ability to hide giving amounts from general users — that’s a legitimate question to put to their support team, and a legitimate factor when you next review the contract.

    What to do this week

    Export the user list. Just that, first — it takes five minutes and it will tell you more about your actual risk than an hour of reading.

    Then spend fifteen minutes on the two highest-value items: close the accounts nobody recognizes, and check who can see giving amounts. If the answer to that second one is “everybody,” fix it today. It’s usually a single setting, and it’s the one your congregation would most want fixed.

    Permissions are one of the fastest wins available to most churches. MissionDefend’s free assessment asks straightforward questions about how your organization handles member data, donations, email and accounts — no jargon, no product pitch — and returns a baseline score with a ranked list of what to address first.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report.

  • Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Nobody hired you for this.

    You were the office administrator, or the associate pastor, or the one person who was comfortable with computers when the church moved its email over four years ago. The consultant set it up, handed you a login, and left. Since then you’ve added staff accounts, reset a few passwords, and hoped.

    Somewhere in that system are a dozen switches that would meaningfully protect your organization, and nobody ever told you they existed. They’re not hidden. They’re just off, because that’s how they shipped.

    Here are ten of them, in the order I’d do them, with an honest note on each about what it might break. That last part is the bit usually left out — and it’s the reason people abandon this halfway through, when a change nobody warned them about breaks the newsletter on a Friday afternoon.

    A note on menus, and on the word “admin”

    Both platforms redesign their admin console regularly. So this article describes each setting by what it does, not by which menu it’s under. Search the admin console’s own help for the concept name and you’ll find it faster than any screenshot from last year would have taken you.

    And to be plain about the word: an administrator account is the login that can create and delete other people’s accounts, read their mail, and change any setting here. In most churches, one or two people have that power and don’t think of themselves as having it. If your everyday account is also the administrator account, every phishing email you receive is aimed at the keys to the whole building.

    Start here: the two that carry the whole afternoon

    1. Multi-factor authentication for every single person. Multi-factor authentication — MFA, or 2-Step Verification in Google’s language — is the extra step after your password: a prompt on your phone, a code, a tap. Microsoft’s own research puts it at blocking more than 99.2% of account compromise attacks. Everything else in this article is a rounding error next to it.

    Do the administrator account first, and carefully. Microsoft now requires MFA to sign in to its admin portals at all, having rolled that out through 2024 and 2025, so this may already be forced on you. Set it up while you are sitting at a computer you control, with the phone in your hand, and confirm you can sign out and back in again before you touch anyone else’s account.

    Time: fifteen minutes for the admin account, then a few minutes per person.
    What it might break: older mail apps and desk devices that only know how to send a password — a copier that scans to email, a legacy accounting tool, a spouse’s ancient phone mail app. Make a list of those before you enforce it organization-wide, because they will fail silently and you’ll spend an afternoon chasing why the scanner stopped working.

    2. A second administrator account, so one lost phone doesn’t lock everyone out. This is the step people skip, and it’s the one that produces the worst days. If exactly one person is the administrator and their phone goes in a lake, nobody can add a staff member, reset a password, or recover a mailbox until a support process that takes days is finished.

    Create a second administrator account. Give it to a second trusted person, or keep it as a rarely-used emergency account with its credentials sealed in the safe where the church keeps its other important documents. Note that Microsoft requires MFA on emergency accounts too and suggests a passkey or a certificate rather than a phone, precisely so the emergency account doesn’t depend on the same phone as everything else.

    Time: ten minutes.
    What it might break: nothing — but a forgotten emergency account with a stale password is worse than none, because you’ll rely on it. Sign into it once a quarter.

    Mail: make impersonation and quiet theft harder

    3. Warning banners on mail from outside the organization. Both platforms can mark messages that came from outside your own domain, so a note claiming to be from your senior pastor visibly isn’t. Microsoft calls this external sender identification; it’s an organization-wide setting an administrator controls, and in most tenants it has to be switched on rather than being on already — check yours rather than assuming either way. Google has equivalent external-sender warnings.

    This is the cheapest defence there is against display-name impersonation — the trick where an attacker sets the friendly name on their account to “Pastor Dave” and your phone shows only that name.

    Time: ten minutes, though on Microsoft the tag can take a day or two to start appearing.
    What it might break: very little, but expect confusion in week one. Tell staff in advance, and tell them what the banner means: not this is dangerous, but this did not come from inside our organization. Some legitimate senders — your denominational office, a mailing service you use — will be tagged, and that’s correct behaviour.

    4. Block or alert on automatic forwarding to outside addresses. This is how theft goes unnoticed. An attacker who gets into a mailbox often sets a rule that quietly copies every message to an address they control, then leaves. They may never send anything from your account at all; they simply read your mail for months, learn your vendors and your payment cycle, and strike once.

    On Microsoft, automatic external forwarding is now blocked by default under the outbound spam policy — but confirm it, because a previous administrator or consultant may have switched it on. Google has an administrator setting that removes the automatic forwarding option from users entirely.

    Time: ten minutes.
    What it might break: real forwards people rely on. The retiring treasurer forwarding church mail to a personal address. A shared role account feeding someone’s personal inbox. Under Microsoft’s block, those messages bounce back to the sender with a message about external forwarding not being allowed — which is confusing if you weren’t expecting it. Find the legitimate forwards first, replace them with a proper shared mailbox or a group, then turn the block on.

    5. Audit the mail rules that already exist. Blocking new forwarding doesn’t remove what’s already there. In each staff mailbox — especially anyone who touches money — look at the rules and filters. You’re looking for anything the person doesn’t remember creating, and in particular for rules that file messages containing words like invoice, payroll, deposit, or bank into an unread folder or straight into deleted items. That’s a rule an attacker writes so the victim never sees the confirmation of what’s being done in their name.

    Time: five minutes per mailbox, and worth doing for everyone once.
    What it might break: nothing, if you ask before you delete. Some people have genuinely elaborate filing rules. Ask, don’t assume.

    Apps and evidence

    6. Review which third-party apps have been granted access. Over the years, staff have clicked “Allow” on things — a scheduling tool, a PDF signer, a survey app, something that promised to make Sunday easier. Each grant can carry standing permission to read mail or files, and it survives a password change. It also survives the departure of the person who granted it, and the closure of the company that built it.

    Both platforms list these. Microsoft shows the applications with permissions in your tenant; Google’s app access control lets you see connected apps and mark them trusted, limited, or blocked. Look for anything you don’t recognize or no longer use, and remove it.

    Time: twenty minutes, and genuinely interesting the first time.
    What it might break: a tool someone actively uses. Revoke, then tell people to speak up if something stops working — that’s a faster route to an accurate inventory than trying to research each one.

    7. Turn on audit logging before you need it. Audit logs record who signed in, from where, what they changed, what they downloaded. You will not care about this until the morning you need to answer “what exactly did they get into?” — and at that point, if logging was off, the answer is permanently unavailable. There is no way to go back and collect it.

    Here’s a detail worth knowing: Microsoft turns auditing on by default for most organizations, but not for the small-business licenses most churches actually hold — Business Basic, Business Standard, and Business Premium. On those, an administrator has to enable it. Once on, activity is retained for 180 days by default. Google Workspace keeps admin and login audit logs available in the admin console.

    Time: ten minutes.
    What it might break: nothing at all. This is the purest cost-free item on the list.

    Files and accounts

    8. Fix the sharing defaults on the shared drive. Both platforms let you choose what happens by default when someone shares a file: a link anyone on the internet can open, a link anyone inside the organization can open, or access granted to named people only. Many organizations are still on a permissive default, which means well-meaning staff have been generating public links for years without realizing it — for budgets, board minutes, and membership lists.

    Change the default so sharing requires naming a person. Then spend ten minutes looking at what is currently shared broadly.

    Time: thirty minutes including the review.
    What it might break: this is the item most likely to cause friction. Volunteers who open a bulletin template through a link may lose access. Anything you publish deliberately — a public calendar, a sermon archive — needs to be re-shared correctly. Do this one on a Monday, not a Saturday.

    9. Remove dormant accounts. The youth intern from two summers ago. The bookkeeper who left in 2021. The volunteer who set up your website and hasn’t been seen since. Each is a live door with a password that has never been changed and no MFA on it.

    Don’t delete immediately — on both platforms, deleting a user can take their files and mail with them. Suspend or block sign-in first, keep the account for a defined period, tell anyone who might need something from it, then remove it.

    Time: twenty minutes.
    What it might break: access to files owned by that person that other people still use. That’s exactly why you suspend before you delete.

    10. Know where “sign out everywhere” is — before the emergency. Changing a password does not always eject someone who is already signed in; active sessions can persist. Both platforms have a control that terminates every session for a user and forces a fresh sign-in — Microsoft describes it as revoking sessions, Google as signing the user out and resetting sign-in cookies.

    You are not turning anything on here. You are finding the button now, while it’s calm, and writing down where it is. The day you need it, you’ll need it in the next ninety seconds.

    Time: five minutes.
    What it might break: when used, it signs that person out of everything and they’ll have to log back in. That’s the point.

    What to do this week

    Block out ninety minutes and do items one and two: multi-factor authentication on the administrator account, done carefully, and a second administrator account created and written down where the church keeps its important papers.

    Then turn on audit logging, because it takes ten minutes, costs nothing, breaks nothing, and can only be done in advance.

    That’s the honest scope of this article: it’s an afternoon, not a project. And the first item alone is most of the benefit — if you only ever get one thing done, get MFA on every account and treat the rest as a bonus.

    MissionDefend’s free assessment covers exactly this ground in plain English — how your email, donations, member data and accounts are actually set up — and hands back a ranked list, so you know which of these ten to spend your one available afternoon on.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, mandatory multifactor authentication guidance; Microsoft, Set-ExternalInOutlook (external sender identification); Microsoft, manage emergency access admin accounts; Microsoft, configure external email forwarding controls; Microsoft, turn auditing on or off; Microsoft, revoke user access in an emergency; Microsoft, manage sharing settings for SharePoint and OneDrive; Google, protect your organization with 2-Step Verification; Google, let users automatically forward their own Gmail; Google, control which apps access Google Workspace data; Google, manage external sharing for your organization; Google, administrator privilege definitions.