The Principle of Least Privilege, Explained

The principle of least privilege is a security rule that says every user, account, and device should have only the minimum access needed to do its job, and nothing more. If someone only needs to read a folder, they should not be able to edit or delete it. Applied properly, it is one of the most effective and least expensive ways to limit the damage a compromised account or piece of malware can do.

Key facts

• Least privilege means granting the minimum access required for a role, and no more.
• It limits the "blast radius" of a breach: a compromised account can only reach what it was allowed to reach.
• It is a core part of the zero trust security model and the ACSC Essential Eight strategy "restrict administrative privileges".
• Standing administrator access is one of the most common and most dangerous over-privilege problems in SMEs.
• Just-in-time access grants elevated rights only when needed and removes them automatically afterwards.
• Least privilege applies to people, service accounts, applications, and devices alike.

What is the principle of least privilege?

The principle of least privilege is the practice of giving each user or system the least amount of access needed to perform its function. It is an old and well-established idea in security, and its logic is simple: access you do not grant cannot be abused. If a staff member in accounts only needs the finance system, they should not also have access to HR records, the file server's admin share, and the firewall settings. The more access each account holds, the more an attacker gains when that account is compromised.

It applies to more than just people. Service accounts, applications, and devices should all run with the minimum permissions they need. A common and costly mistake is running software or scheduled tasks under a full administrator account "to make it work", which hands an attacker the keys if that process is exploited.

Why does least privilege matter so much?

Least privilege matters because it contains the damage of a breach: when an account is compromised, the attacker inherits exactly that account's access, so less access means less harm. Security people call this limiting the blast radius. If every user has broad access, one phished password can expose the whole business. If access is tightly scoped, that same phished password reaches only a small, contained area. In our experience supporting Sydney SMEs, the businesses that weather a security incident best are almost always the ones where access was properly segmented, so a single compromised login did not open every door in the building.

There is a productivity myth worth addressing here. People assume least privilege means constantly being blocked from things they need. Done well, it does not, staff get smooth access to what their role requires, and only the genuinely sensitive or rare actions need an extra step.

How does least privilege relate to zero trust?

Least privilege is one of the three founding principles of zero trust, alongside "verify explicitly" and "assume breach". A zero trust approach assumes any account could be compromised, so it grants the narrowest possible access and verifies every request using technology like zero trust network access. You cannot really claim to be doing zero trust without least privilege at its core. The two ideas reinforce each other: verify who someone is, then give them only what that verified identity is entitled to.

How do you apply least privilege in a small business?

You apply least privilege by auditing who has access to what, removing access nobody needs, and using just-in-time elevation for administrative tasks. The practical starting points for an SME are usually: remove standing local administrator rights from staff laptops, stop sharing a single admin login, review who has access to shared drives and cloud folders and trim it back, and separate everyday accounts from administrative ones so admins do not browse the web and read email as a domain admin. From there, just-in-time access, where elevated rights are granted only for the moment they are needed and then automatically revoked, closes the gap further. None of this requires expensive tooling to begin; much of it is configuration and discipline.

Frequently asked questions

What is an example of least privilege?

A simple example: a receptionist needs to use the booking system and email, so their account is granted access to exactly those and nothing else. They do not have access to payroll, server settings, or the ability to install software. If their account is later compromised through a phishing email, the attacker can reach only the booking system and mailbox, not the entire business.

Is least privilege the same as zero trust?

No, but they are closely related. Least privilege is one of the core principles that zero trust is built on. Zero trust is the broader model, which also includes verifying every request explicitly and assuming a breach has already happened. You apply least privilege as part of implementing zero trust.

What is just-in-time access?

Just-in-time access is a way of applying least privilege to administrative rights by granting elevated permissions only when they are needed and automatically removing them afterwards. Instead of an IT staff member holding permanent administrator access, they request it for a specific task, use it, and it expires. This shrinks the window in which those powerful rights could be abused.

Does least privilege apply to Microsoft 365?

Yes. In Microsoft 365 and Entra ID, least privilege means assigning users the narrowest roles that let them do their job, avoiding blanket Global Administrator rights, and using tools like Privileged Identity Management to grant admin roles just in time. Over-assigning Global Administrator is one of the most common and risky misconfigurations we see in SME tenants.

If you are not certain who in your business has access to what, or you suspect too many people hold admin rights, that is worth checking before something goes wrong. We can run an access review and tidy it up. Call us on 1800 367 448.