Least Privilege: Why Admin Rights Turn Small Incidents Into Big Ones

The principle is simple: everyone gets exactly the access their job requires and nothing more. What makes it matter is what happens when something goes wrong. The same phishing click is a minor cleanup on a standard account and a company-wide incident on an administrator one.

The difference in practice

Picture the same bad afternoon twice. An employee clicks a link and malware runs.

If they were a standard user: the malware runs with their permissions. It can reach their files and the shares they use. It can't install services, disable security tools, or reach into other people's data. You isolate the machine, restore from backup, and the business continues.

If they were a local administrator: the malware installs itself properly, disables the antivirus, harvests credentials from memory, and uses those to move to other machines. If the credentials it finds belong to a domain administrator, the whole network is now in play — including the backup server.

Nothing about the initial click differed. The only variable was what the account was allowed to do, and that variable decided whether you had an incident or a disaster.

Why almost every small business has this problem

Nobody decides to over-permission their staff. It accumulates:

• A line-of-business application wouldn't install without admin rights, so the user was made an admin "for now"
• A previous IT provider found it faster to grant access than to troubleshoot permissions
• Someone changed roles and gained the new team's access while keeping the old
• A contractor was given broad access to get a project moving
• An owner asked for access to everything, which is understandable and also makes them the highest-value target in the company

Each decision was locally reasonable. The cumulative result is a network where a large share of accounts can do far more damage than their job requires.

The five things to actually do

1. Separate admin accounts from daily accounts

Anyone who needs administrative rights gets two accounts: a normal one for email, browsing, and daily work, and a separate privileged one used only for administrative tasks. The privileged account never reads email and never browses the web — which removes the two routes by which accounts actually get compromised.

This one change does more than everything else on this list combined.

2. Remove local admin from workstations

Most users don't need it. The ones who think they do usually need one specific thing — installing a printer, updating a particular application — which can be granted specifically without handing over the whole machine.

Expect to find one or two badly-written applications that genuinely require elevation. Solve those individually rather than abandoning the project for everyone.

3. Review access when roles change

Access accumulates because onboarding grants it and role changes never revoke it. When somebody moves teams, their old access should be removed, not merely supplemented. Build it into the process rather than relying on anyone remembering.

4. Offboard properly and immediately

Departed employees with live accounts are a genuinely common source of incidents and an entirely self-inflicted one. Disable on the last day, not the following month. Convert mailboxes to shared mailboxes if the email needs retaining — that removes the login while keeping the data, and doesn't consume a license.

5. Audit twice a year

List everyone with administrative rights in Microsoft 365, on servers, and on workstations, and confirm each one still needs it. Also check the non-obvious places privilege hides: your domain registrar, your accounting platform, your remote access tooling, and any service accounts.

Half an hour, twice a year. The list is always longer than expected.

Handling the pushback

The objection is always the same: this will slow people down. Sometimes it does slightly, and that's a real cost worth acknowledging rather than dismissing.

What makes it manageable is responsiveness. If a request for elevated access takes three days, people will find workarounds and your policy becomes theater. If it takes ten minutes, nearly everyone accepts it. The success of least privilege depends less on the policy than on how quickly you can say yes when the answer is yes.

For leadership specifically, the framing that works: broad access makes you the single most valuable target in the company. Attackers research who the owner is. Reducing what that account can reach is protection for them, not a limitation on them.

Common questions

Does this need extra software?

Not to start. Separate admin accounts and removing local admin rights are configuration, not purchases. Microsoft 365 Business Premium adds useful controls on top — conditional access and Privileged Identity Management — if you already have it.

How does this relate to zero trust?

Least privilege is one of zero trust's core components. You don't need the full framework to benefit — the access discipline delivers most of the value on its own.

Where does this sit against MFA and backups?

Third. MFA stops the compromise; tested backups let you recover; least privilege limits how bad it gets in between. All three appear in our security baseline.