Least-Privilege Practices Can Reduce the Impact of Compromised Accounts

Summary

Huntress recommends reducing unnecessary admin access, separating admin accounts from everyday email and browsing, reviewing sensitive-data permissions, and making access reviews part of routine processes to limit the impact of compromised credentials.

Key points

Excessive local admin rights and persistent admin sessions can increase the impact of a phished or compromised account.
Separate admin accounts from mailboxes and use them only for administrative work.
Review access to financial, HR, and intellectual property data, and limit it to people who need it.
Check SaaS procurement and ownership for unintended administrators outside IT’s usual processes.
Build access reviews into onboarding and offboarding, and reassess permissions regularly to catch drift.
Start with one system or account group and provide a straightforward process for requesting additional access.

Article Details

Defense Focus: Reduce excessive standing privileges and keep access aligned with users’ current job requirements.
Detection Methods: Inventory local administrator rights and identify users who do not need them.
Review administrator accounts for mailbox access and use of the same account for email or web browsing.
Map access to financial data, HR records, and intellectual property, and identify access that is no longer needed.
Audit SaaS and software procurement for administrators created outside the usual IT process.
Reassess access every six months and check for changes from the established baseline.
Data Sources: Local administrator assignments
Administrator account and mailbox access
Permissions for financial data, HR records, and intellectual property
SaaS and software procurement records
Onboarding, offboarding, and role-change access records
Platforms: Microsoft 365
SaaS platforms
Defensive Actions: Remove local administrator rights from users who do not need them for their jobs.
Separate administrator accounts from mailboxes; use a standard account for email and browsing.
Limit access to sensitive data to people who need it for their work.
Include privilege reviews in onboarding and offboarding so access changes when roles do.
Review SaaS and software procurement for unintended administrator assignments.
Provide a straightforward process for requesting additional access.
Add role-based access questions to vendor and software evaluations.

People

Beth RobinsonAuthor of the article.Bryson ByrdAcknowledged for contributions to the article.Natalie SuarezAcknowledged for contributions to the article.

Vendors

HuntressSee Huntress in action MicrosoftSomewhere this year, an IT admin probably flipped on Microsoft Copilot for their organization and watched it surface information nobody should have been able to see: confidential board plans, the CEO's salary, HR files

Products

Managed Identity Security Posture Management (ISPM)Ready to start improving your organization's privilege hygiene? Start your free trial of Managed Identity Threat Detection and Response (ITDR) or Managed Identity Security Posture Management (ISPM).Managed Identity Threat Detection and Response (ITDR)Ready to start improving your organization's privilege hygiene? Start your free trial of Managed Identity Threat Detection and Response (ITDR) or Managed Identity Security Posture Management (ISPM).Microsoft 365on a network, and the answer is almost always who has admin rights. When you give every user in a Microsoft 365 environment global admin permissions, any of those logins turns into an existential threat to the