Acknowledgments: Special thanks to Natalie Suarez and Bryson Byrd for their contributions to this write-up.
Somewhere this year, an IT admin probably flipped on Microsoft Copilot for their organization and watched it surface information nobody should have been able to see: confidential board plans, the CEO's salary, HR files that were supposed to stay inside one small team. None of that access was new, but Copilot made it visible across the organization.
The problem is rarely a hack. It's the permissions already sitting open.
Ask a pen tester what they check first on a network, and the answer is almost always who has admin rights. When you give every user in a Microsoft 365 environment global admin permissions, any of those logins turns into an existential threat to the entire tenant. Compromising one account in that setup potentially gives the attacker access to the entire environment since there was nothing standing between that login and everything else.
That's the actual case for least privilege: making sure a single mistake, one phished password or one leaked credential, can't take the rest of the business down with it. Good privilege hygiene works as a backstop. It narrows the blast radius so an attacker who gets a foothold hits a wall instead of a hallway.
Where the gaps actually live
The most common privilege hygiene gap is having too many local admin rights within a single environment. While it might seem convenient to give every employee admin access to their own workstation, there's zero benefit to your security posture. Just because provisioning a laptop with standing admin rights is faster than provisioning one without, doesn't mean you should give attackers easy access.
A second common pattern we see is admin accounts that stay connected to mailboxes for too long. An IT person logs into an admin account to handle a ticket, then reads email and browses the web from that same account for the rest of the day. That small oversight, combined with a phishing email, could be a free ride to unauthorized access to a domain controller.
Then there's the access nobody assigned on purpose. Procurement moves faster than IT, and someone six months into a job in accounting ends up as the admin on a SaaS platform that runs the company's finances, simply because they were the one who signed up for the trial. That person now owns the account and holds the keys to it. If they're compromised, that's a problem. If they leave the company, that's a bigger one. It became the default even though nobody made that decision on purpose.
Least privilege is a practice, not a project
Least privilege is an ongoing journey, not a one-time decision. It can sound like a massive cleanup project, especially when years of access decisions have piled up across systems, users, and vendors, but it doesn't have to start that way.
Pick one place to begin. A business-critical application, a group of local admins, or the people who can access financial data, HR records, and intellectual property. Look at what each person actually needs to do their job, remove what no longer fits, and make it easy to request access when someone genuinely needs more.
You won't get every permission decision right on the first pass. That's okay. Revisit access on a regular schedule, catch drift as roles and tools change, and carry those same questions into onboarding, offboarding, and new software purchases. Over time, those small decisions add up to stronger privilege hygiene.
Small changes, stronger privilege hygiene
You don't need to untangle every permission in your environment at once. Start with one system, one group of accounts, or the data that would cause the most trouble in the wrong hands.
These steps can help you find the biggest gaps, make a few practical changes, and build a review process that keeps access from quietly sprawling again:
Inventory who currently has local admin rights on their workstation, and remove it from anyone who doesn't need it for their job
Separate every admin account from a mailbox. Admins should log in to do admin work, then switch back to a standard account for email and browsing.
Map who has access to your most sensitive data (financials, HR records, intellectual property) and cut that list down to the people who actually need it
Build privilege review into onboarding and offboarding, so access changes the moment a role does
Audit SaaS and software procurement outside of IT's usual process to catch accidental admins nobody assigned on purpose
Pick one application or system to start with instead of trying to overhaul every environment at once
Re-evaluate access every six months and look for drift from your baseline
Add role-based access questions to vendor and software evaluations before you buy
Build a simple, low-friction process for employees to request additional access when they genuinely need it
Privilege hygiene works best when you can see where access is expanding and catch risky changes before they turn into a bigger problem.
Ready to start improving your organization's privilege hygiene? Start your free trial of Managed Identity Threat Detection and Response (ITDR) or Managed Identity Security Posture Management (ISPM).
