Cybersecurity
MFA and PAM Solutions in Saudi Arabia for Remote and Admin Access
Multi-factor authentication (MFA) stops stolen passwords from being enough to get in. Privileged access management (PAM) controls who can use admin accounts and records what they do. Both help Saudi companies meet NCA and Aramco CCC access controls.
- Microsoft Entra, Sophos and Fortinet
- Remote access and admin accounts
- Supports NCA NCNICC controls
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Why MFA and PAM solutions in Saudi Arabia are a priority
Stolen or guessed passwords remain one of the easiest ways into a company network. MFA and PAM solutions in Saudi Arabia close that door. MFA asks for a second proof, such as an app approval or a token, before anyone signs in. PAM limits and records the use of powerful admin accounts.
Waves Telecom is a Microsoft partner and a Sophos and Fortinet Gold Partner, with 10 years in cybersecurity. We roll out MFA on the systems you already use, then put controls around admin access without slowing your IT team down.
Admin accounts deserve extra care. One compromised domain admin or firewall admin can switch off protection across the whole company. PAM makes sure those rights are used only when needed, by the right person, and leave a clear record.
- MFA for Microsoft 365, VPN and remote access
- Conditional Access rules in Microsoft Entra ID
- Just-in-time admin rights and approval workflows
- Separate admin accounts and session logging
The NCA controls behind MFA and PAM
The NCA's NCNICC-1:2025 controls for private companies name these items directly. A consultancy summary reports that control 2-2-1-2 requires MFA for remote access, including external applications, and control 2-2-1-4 adds privileged access management. The controls apply to entities the NCA notifies, and no public notifications had been confirmed as of July 2026.
Aramco CCC auditors also check how remote and admin access is protected. Putting MFA and PAM in place now helps with both, and the same settings and reports can be reused as evidence at each CCC renewal.
NCNICC controls 2-2-1-2 (MFA for remote access) and 2-2-1-4 (privileged access management), per Uniqus, Jul 2026.
How Waves rolls out MFA and PAM
Access review
We list every way into your network: Microsoft 365, VPN, remote desktop, cloud apps and admin consoles.
MFA for users
We enable MFA in Microsoft Entra ID and on your Sophos or FortiGate VPN, starting with remote access.
Clean up admin accounts
We remove shared and unused admin accounts and give admins separate accounts for admin work.
Add PAM controls
We set up time-limited admin rights, approvals and logging with Microsoft Entra Privileged Identity Management or FortiPAM.
Evidence and handover
We document the settings and give you reports you can show auditors.
Tools we use
Microsoft Entra ID
MFA and Conditional Access for Microsoft 365 and connected apps. Uses the Microsoft Authenticator app.
Microsoft Entra PIM
Privileged Identity Management for just-in-time admin roles with approval and audit history. Requires the right Entra licence.
Fortinet FortiAuthenticator and FortiToken
MFA for FortiGate VPN, admin logins and on-premise apps.
Fortinet FortiPAM
Privileged access management with credential vaulting and session recording for servers and network devices.
Sophos Firewall and Sophos ZTNA
MFA for VPN and zero trust access to internal apps, managed from Sophos Central.
Hardware tokens
Physical tokens for staff who cannot or prefer not to use a smartphone app for sign-in.
Brands and partners
MicrosoftFortinetSophosDellHPE
Frequently asked questions
What is the difference between MFA and PAM?
MFA protects every user's sign-in with a second factor. PAM focuses on admin accounts, limiting when they can be used and recording what they do. Most companies need MFA first, then PAM.
Do we need new licences for MFA in Microsoft 365?
Basic MFA is available in Microsoft 365, but Conditional Access and Privileged Identity Management need higher Entra ID plans. We check your current licences and tell you what, if anything, you need to add.
Will MFA annoy our staff?
It adds a few seconds at sign-in. With Conditional Access, we can ask for MFA less often on trusted company devices and more often from new locations.
Is MFA required by the NCA?
The NCA's NCNICC-1:2025 controls include MFA for remote access and privileged access management, according to a published consultancy summary. They apply to private companies the NCA notifies. Other NCA frameworks and Aramco CCC also expect strong access controls.
Can you add MFA to our FortiGate or Sophos VPN?
Yes. We use FortiToken with FortiAuthenticator, built-in options on Sophos Firewall, or Microsoft Entra ID, depending on your setup.
What if a staff member loses their phone?
We set up a recovery process so IT can verify the user and reset their MFA quickly. Hardware tokens are also an option for staff without smartphones.
Does PAM help with Aramco CCC?
Yes. Limiting and logging admin access supports the access controls auditors check. We have supported 150+ companies through Aramco CCC, and all of them passed.
Book an access review
We will map how users and admins sign in today and show where MFA and PAM are needed first.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
