Subcontractor Access Management in Construction: Accounts, Tablets and Project Data

Why is a construction company harder to secure than an office of the same size?

Because most of the people who need your data are not your staff, most of the devices they use are not yours, and the money moving through your accounts is large enough to be worth a targeted attack. A contractor with a few dozen employees can easily have several times that number of external people with a legitimate reason to open a drawing this week.

Five things make the difference. External people: consultants, subcontractors, the client's representative, suppliers and testing agencies, all of whom need the current drawing set, the programme and the forms, and all of whom arrive and leave on the project's timetable rather than yours. Shared devices: a tablet in a site cabin is passed between the foreman, the QA inspector and the safety officer, and nobody is quite sure whose account it is signed into. Sites: a cabin on mobile data behind a consumer router, opened at six in the morning by contractors on site at odd hours, and left open over the Saturday-Sunday weekend. Large payments: valuations and interim certificates that dwarf anything a professional-services firm pays a supplier. And long projects: over eighteen months or more, people join, change employer and leave, and the account list quietly stops matching the people on site.

An office of the same headcount has a fixed door, company laptops, one internet line and a payroll run. Each of the construction factors above maps to a specific failure: account sprawl, device loss, invoice fraud and ransomware. The rest of this article takes them in the order that matters, and our page on IT support for construction companies covers the wider setup around them.

How should subcontractor access management work for project files?

Give each external person a guest account in your Microsoft 365 tenant tied to their own company email address, put the project's files in a site created for that project, grant access through a group, and set an expiry date. Never create a shared login, however convenient it looks on the day a new subcontractor arrives.

The shared login is the root of most construction data problems. A mailbox called site office, or a single drawing-portal user shared by a whole trade, ends up with its password on a whiteboard in the cabin and in three WhatsApp groups. It is still valid two projects later. You cannot tell which person downloaded the tender pricing, and you cannot remove one individual without changing the password for everyone, so nobody does.

A guest account solves each of those. The subcontractor's engineer signs in with the credentials their own employer gave them, so when that employer disables the account on the day the engineer leaves, your access goes with it. You see a named person in your sign-in and file logs. You can remove one guest without touching anyone else. And because each project has its own SharePoint site or Teams team, a consultant on one job sees issued drawings for that job and nothing else: not the tender folder, not the other three sites, not finance.

Sharing rules matter as much as accounts. Turn off links that work for anyone who holds them, and share to specific people or groups instead. Name an owner for each project site, usually the project manager or document controller, who approves new guests and reviews the list monthly. Then decide what a guest must present before they get in. Microsoft documents how Conditional Access decides whether a sign-in is allowed and what it must first satisfy, such as a second factor or a known device, and those policies can be applied to guests as well as staff. A tenant without Conditional Access licensing can instead switch on security defaults, Microsoft's preconfigured baseline, which among other things requires every user to register for multi-factor authentication. Our guide to MFA for small businesses covers the choice in more detail.

• One guest account per external person, tied to their employer's email, never a shared login.
• One site or team per project, with access granted through groups rather than to individuals.
• Expiry dates on every guest, reviewed by the project site's named owner.
• Anyone-links disabled; sharing only to specific people or groups.
• MFA or a known device required before a guest gets in.

How do you manage shared tablets and laptops on site?

Shared devices are acceptable on site if they are enrolled in device management, nobody's password is saved on them, company data lives only inside managed apps, and someone at head office can wipe them without visiting the cabin. A tablet that fails any one of those tests is a liability in a cabin that is rarely locked.

The site reality is unglamorous. A tablet is handed from the foreman to the QA inspector to the safety officer during the same shift. It lives in a cabin where the air conditioning fights the summer heat and loses on Fridays when nobody is there. It connects over mobile data, drops on concrete, and is left on a desk over the weekend. The mistake is to treat it like a personal laptop and save the site manager's account on it, at which point everyone who picks it up is the site manager as far as your systems are concerned.

Set shared tablets up so each person signs in with their own account and is signed out when they hand it over, with a short screen lock and no passwords stored in the browser. Keep company data in managed apps only, so it can be removed without touching anything else. Microsoft documents how app protection policies keep company data inside managed apps and allow it to be selectively wiped, which is the mechanism that makes a shared device tolerable. The same policies apply to a subcontractor's engineer opening your drawings on a personal phone, without you owning or controlling that phone.

Keep a register: which device is at which site, its asset tag, who signed it out and when it was last seen checking in with management. When a device stops checking in for a week, somebody asks where it is. The honest limit is photographs. A photo taken with the phone's own camera and sent over a personal WhatsApp group is outside your control, whatever policy you write. The practical answer is a company-approved app for site photos and forms, with the camera roll kept out of it, and a rule people can actually follow on a site.

• Every shared device enrolled in management before it goes to site, with a lockable enclosure or drawer in the cabin.
• Per-person sign-in, short screen lock, no saved passwords, sign-out on handover.
• Company data in managed apps only, so a remote wipe removes it and nothing else.
• A device register with location, asset tag, custodian and last check-in.
• An approved app for site photos and forms rather than the camera roll and WhatsApp.

How do you stop invoice and payment fraud on large contracts?

The most effective control is procedural, not technical: any change to a supplier's or subcontractor's bank details is confirmed by phone, on a number you already hold from the original contract, before anything is paid, without exception. The technical controls exist to make that rule harder to bypass and the attacker's job harder to start.

The attack is patient. Someone compromises a mailbox, often at a subcontractor rather than at you, and reads for weeks. They learn who signs valuations, when interim payments run, and how the finance manager writes. Then, a day or two before a large payment, a letter arrives on the right letterhead announcing new bank details, sometimes sent from the supplier's genuine mailbox. It arrives on a Thursday afternoon, the payment is due before the weekend, and the site cannot afford a supplier downing tools. Everything about a construction payment cycle favours the attacker.

The controls sit on identities and email, which is the part an IT company can build. Multi-factor authentication on every finance, director and project manager account, with no exceptions for people who find it inconvenient. Alerts when a mailbox forwarding rule is created, because that is how the attacker keeps reading. Impersonation and anti-phishing protection switched on and tuned in your email platform, so a message from a look-alike domain is flagged before it reaches a busy quantity surveyor. Two people involved in any bank-detail change, one of whom makes the phone call. Your accounting or project software sits on top of that; Listonics does not supply or manage it, but the identities, mail flow and devices underneath it are where this attack is caught.

Write the rule down, put it in the contract with every subcontractor so their finance team expects the call, and say explicitly that nobody will be blamed for delaying a payment by a day to verify it. The blame, when a payment goes to the wrong account, is far worse.

What should happen when a subcontractor or site staff member leaves the project?

On the day they leave, not at month end: their account is disabled or their guest access removed, active sessions are revoked, devices are collected, any shared credentials they knew are changed, and the removal is recorded against their name. Our employee offboarding IT checklist covers the company-staff version; construction adds a project dimension.

People leave projects far more often than they leave companies. A subcontractor's team may be on three of your sites at once and roll off one while staying on the others. A site manager finishes a job on Thursday and starts a new one on Monday. And the site manager knows things no account list records: the cabin Wi-Fi password, the door code, the login for the camera recorder, the mobile router's admin password. Offboarding from a project means changing those too.

• Disable the staff account or remove the guest, and revoke sessions so open apps stop working.
• Transfer ownership of any files, forms or site records they held personally to the project.
• Collect tablets, laptops and any keys or access cards, and update the device register.
• Change the cabin Wi-Fi, router, camera recorder and any other shared passwords they knew.
• Check their mailbox for forwarding rules and their account for personal cloud sync before closing it.
• For a whole subcontractor company at practical completion, remove all of its guests in one pass.
• Record who was removed, when and by whom, so the project's access history can be reconstructed later.

What does a realistic security baseline look like for a mid-sized contractor?

MFA everywhere, named accounts with expiry, managed devices, email protection, tested offline backups and a written response plan, in that order. Ransomware is the realistic threat to a construction company because it does not need to target you specifically; it needs one stale account, one unpatched laptop in a cabin, or one shared password that leaked a project ago.

A contractor hit by ransomware cannot work. The drawing register, the programme, the valuation records and the site diaries are all encrypted at once, and the attackers routinely go for the backups first, which is why a backup on the same network as the files it protects is not a backup. The CISA #StopRansomware Guide sets out the prevention practices and a response checklist that a mid-sized firm can actually follow, and its emphasis on offline or immutable backups that are tested by restoring is the single item most contractors have not done.

The baseline below is prioritised. Do the first three this month; they stop the majority of realistic attacks. The rest follow as budget and attention allow, and our guide to cybersecurity for small business in Dubai sets out how each is delivered.

One more piece that is easy to forget: the network in the site cabin. Cameras, the time-and-attendance terminal and the subcontractors' own laptops should sit on separate networks from the site manager's, and the cabin should not expose anything to the internet. That design is covered in our post on construction site office internet setup, and it is the same segmentation principle that keeps a compromised camera from reaching your files.

• First: multi-factor authentication on every account, staff and guest, with finance and directors enforced immediately.
• Second: named accounts only, per-project sites, guests with expiry dates and a monthly review by each site owner.
• Third: backups of email, SharePoint and any head office NAS held offline or immutable, with a restore tested and timed.
• Fourth: every laptop and shared tablet enrolled in management, with endpoint protection, encryption and remote wipe.
• Fifth: anti-phishing and impersonation protection on email, with alerts on new forwarding rules.
• Sixth: the written bank-detail rule and the offboarding steps above, agreed with finance and project managers.
• Seventh: segmented site networks, no remote access exposed to the internet, and a one-page plan saying who does what when something is encrypted.

How Listonics helps with subcontractor access and project security

Listonics starts with a free assessment of your Microsoft 365 tenant, site devices and network: who currently has access, which guests have no expiry, which shared logins exist, whether MFA is enforced and whether a backup has ever been restored. From that we quote a fixed-scope, itemised proposal covering guest access and per-project sites, Conditional Access and MFA, device management for laptops and shared tablets, email protection, backup with tested restores, and segmented cabin networks, all under our cybersecurity service. Engineers work on site across Dubai. Ongoing support is a fixed monthly fee per user or per device, and you receive an account list that includes every guest, a device register and a network diagram. Your project management and accounting software stays with its vendors; we coordinate with them. Contact us to book the assessment.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Sep 24, 2026 · Last reviewed September 24, 2026 · 2,678 words