Administrator access should be temporary

A standing control, not a new alert

This is evergreen guidance, not news of a new incident. Administrator accounts exist because somebody must change configurations, manage identities and maintain services. Those same permissions can make an ordinary mistake more damaging and give an attacker far greater reach if the account or its management device is compromised.

The NCSC treats secure administration as a design problem for both IT and operational technology. Its principles include trusting the devices used for management, protecting administration interfaces, separating different levels of administration, applying least privilege, removing access when it is not needed, and logging and auditing administrative activity. These controls apply to staff, suppliers and automated system accounts alike.

Convenience quietly becomes exposure

Permanent broad access is convenient because nobody has to request it twice. It also means the privilege is available during every phishing attempt, stolen session, infected laptop and hurried click. A role granted for one project can remain long after the person changes duties, while shared administrator identities make it harder to establish who performed an action.

Microsoft's current Entra guidance recommends granting a specific set of permissions over a specific scope for a specific period. For its own platform, it recommends just-in-time role activation, multifactor authentication for administrators, recurring access reviews and tight limits on the most powerful roles. Those product features are not universal, but the underlying decisions travel well: minimise privilege, make activation deliberate, expire it automatically where possible and preserve an attributable record.

Least privilege does not mean leaving administrators unable to recover a service. Microsoft separately recommends protected emergency access accounts for lockout scenarios. The practical goal is controlled resilience: normal administration should be narrow and temporary, while exceptional access should be deliberately designed, secured, monitored and tested rather than improvised during an outage.

What businesses should do

Begin with an inventory of privileged identities across email, cloud hosting, domain registration, website management, source control, backups, endpoints and network equipment. Include service accounts and supplier access. Record the owner, purpose, permitted systems, authentication method and review date. Investigate dormant, shared or unexplained entries with the service owner before changing them.

Give people an ordinary account for email and routine work, and a separate identity for administration where the platform allows it. Protect privileged identities with strong multifactor authentication and avoid using them from unmanaged or everyday browsing devices. Restrict management interfaces to the users and routes that genuinely require them rather than assuming a password alone is an adequate boundary.

Replace broad roles with task-specific permissions and scope them to the relevant service or resources. Use time-limited activation and approval for high-impact work when the platform supports it. Where it does not, establish a simple issue-and-revoke process with an expiry time and a second person checking powerful grants. Automated accounts need the same discipline: narrow permissions, controlled credentials, a named owner and a removal plan.

Review privileged access after staff changes, supplier changes and completed projects, as well as on a regular schedule. Log sign-ins, role changes and important administrative actions, then make somebody responsible for reviewing exceptions. Test emergency access without using it for ordinary convenience, and store its recovery material so that one unavailable person or device cannot lock the organisation out.

• Inventory human, supplier and automated privileged identities.
• Separate everyday accounts from administrative use.
• Require strong multifactor authentication and trusted management devices.
• Grant the smallest scope for the shortest practical time.
• Review, log and remove privileges under a named owner.

The Beekeeper view

Administrator access is not a job title or a reward for seniority. It is a temporary capability to perform a defined change. Treating it that way reduces the number of credentials that can alter the whole business and makes unusual activity easier to recognise.

Start with the most powerful five accounts, not an enterprise-sized tooling project. Establish why each exists, what it can reach, how it is protected and when it will next be reviewed. If the answer to the expiry question is never, that is a decision worth revisiting.