Least Privilege
Security principle that grants users only the minimum access rights necessary to perform their job functions.
What is Least Privilege?
Least privilege limits the blast radius of account compromise by ensuring users can only access what they need. Rather than granting broad admin rights "just in case," access is granted for specific tasks and revoked when no longer needed. This requires understanding role requirements, regular access reviews, and tooling to manage granular permissions.
In Microsoft 365
Azure AD provides granular administrative roles instead of using Global Administrator for everything. Custom roles can be created for specific scenarios. PIM adds time-limiting to the equation. Entitlement management automates access packages for project-based access.
Examples
- 1Using User Administrator instead of Global Administrator
- 2Custom role for specific Teams management tasks
- 3Time-limited project access through entitlement management
Related TrueConfig Controls
These controls help implement and verify least privilege in your Microsoft 365 environment.