A method for providing secure location based services, the method comprising: receiving (510, 724), from a user device, a set of initial information comprising a beacon identifier; identifying a set of services to be provided to authorized users of the user device based on the beacon identifier; sending (528, 718) to the user device, an authentication challenge; receiving (516, 728) from the user device a response to the authentication challenge, the response to the authentication challenge allowing the user of the user device to be identified; determining whether the response to the authentication challenge is valid; responsive to the determination that the response to the authentication challenge is valid, sending information to the user device describing services that the user is authorized to access; and providing access to a service the user is authorized to access; and receiving, from an administrator, configuration information for at least one cloud service, the configuration information comprising a set of users authorized to act as a beacon for the at least one cloud service; determining whether the user of the user device is a member of the set of users authorized to act as a beacon for the at least one cloud service; responsive to the determination that the user is a member of the set of users authorized to act as a beacon for the at least one cloud service, exchanging information with the user device to place the user device into a state to act as a beacon for the at least one cloud service, the user device having a beacon identifier different from the first identifier; wherein the exchange of information with the user device to place the user device into a state to act as a beacon, further delegates authority to the user device to allow other user devices to act as beacons responsive to the determination that the response to the authentication challenge is not valid, denying access to the set of services. receiving (510, 724), from a user device, a set of initial information comprising a beacon identifier; identifying a set of services to be provided to authorized users of the user device based on the beacon identifier; sending (528, 718) to the user device, an authentication challenge; receiving (516, 728) from the user device a response to the authentication challenge, the response to the authentication challenge allowing the user of the user device to be identified; determining whether the response to the authentication challenge is valid; responsive to the determination that the response to the authentication challenge is valid, sending information to the user device describing services that the user is authorized to access; and providing access to a service the user is authorized to access; and receiving, from an administrator, configuration information for at least one cloud service, the configuration information comprising a set of users authorized to act as a beacon for the at least one cloud service; determining whether the user of the user device is a member of the set of users authorized to act as a beacon for the at least one cloud service; responsive to the determination that the user is a member of the set of users authorized to act as a beacon for the at least one cloud service, exchanging information with the user device to place the user device into a state to act as a beacon for the at least one cloud service, the user device having a beacon identifier different from the first identifier; wherein the exchange of information with the user device to place the user device into a state to act as a beacon, further delegates authority to the user device to allow other user devices to act as beacons responsive to the determination that the response to the authentication challenge is not valid, denying access to the set of services.