Least Privilege
The principle of granting an identity only the access it needs, for only as long as it needs it. Reduces blast radius when an account is compromised.
Least privilege is universally endorsed and rarely measured, which is the whole problem. It becomes real when you can compare granted permissions against used permissions and act on the difference, and when access is time-bound by default rather than permanent. Without those two mechanisms it degrades into an aspiration that entitlement growth quietly overwhelms.
See also: zero standing privileges, CIEM, entitlement, just-in-time access
Related on Start with Identity
- GlossaryStanding Privilege
Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryISPM
Identity Security Posture Management. Continuous assessment of identity-related misconfigurations and risk, such as dormant accounts, weak MFA coverage, and ris
- ArticleLeast Privilege Access: Implementation Strategies and Best Practices
Implement the principle of least privilege with practical strategies for monitoring excess permissions, automated right-sizing, and overcoming organizational re
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVECertifried, AD CS certificate mapping privilege escalation
The 2022 AD CS cert-based privilege escalation, still observed in incident response in 2025 (Rapid7, Unit 42). CVSS 8.8. The durable control is strong certifica