Least privilege is easy to say and hard to maintain. People change roles, projects end and temporary access becomes permanent. The control is not a one-time configuration; it is a review habit.
Start with evidence
You cannot remove permissions you have not found. Build a simple inventory:
- Which accounts have administrative rights?
- Which service accounts can log in interactively?
- Which permissions were granted but never used?
- Which roles exist only because one person needed something once?
Cloud providers and directory services can export effective permissions and last-used data. Use it.
Roles, not people
Role-based access control groups permissions around tasks: "help desk tier 1", "finance approver", "database operator". Users are assigned roles, and roles are reviewed.
Watch for role explosion: hundreds of near-identical roles created for individual exceptions. That is a sign the role model is not keeping up with the work.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.