--- id: CP-197 slug: least-privilege-just-in-time-access lang: en title: Least privilege and Just-In-Time access description: Least privilege limits rights to what is strictly needed, Just-In-Time access grants them for a limited time. What employees do. canonical_url: https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/ markdown_url: https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Least privilege and Just-In-Time access", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/ (CC BY 4.0) wing: 3 theme: control_access reflex: cr-029 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/ fr: https://startbrain.io/cyberpedia/fr/articles/moindre-privilege-acces-jit/ de: https://startbrain.io/cyberpedia/de/articles/minimale-rechte-just-in-time-zugriff/ es: https://startbrain.io/cyberpedia/es/articles/minimo-privilegio-acceso-jit/ sources: - "n": 1 title: least privilege - Glossary | CSRC publisher: NIST url: https://csrc.nist.gov/glossary/term/least_privilege accessed: "2026-11-03" - "n": 2 title: Qu’est-ce que Microsoft Entra Privileged Identity Management ? publisher: Microsoft url: https://learn.microsoft.com/fr-fr/entra/id-governance/privileged-identity-management/pim-configure accessed: "2026-11-03" - "n": 3 title: Meilleures pratiques pour les rôles Microsoft Entra publisher: Microsoft url: https://learn.microsoft.com/fr-fr/entra/identity/role-based-access-control/best-practices accessed: "2026-11-03" - "n": 4 title: Valid Accounts, Technique T1078 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1078/ accessed: "2026-11-03" - "n": 5 title: Authorization - OWASP Cheat Sheet Series publisher: OWASP url: https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html accessed: "2026-11-03" - "n": 6 title: Privileged Account Management, Mitigation M1026 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/mitigations/M1026/ accessed: "2026-11-03" - "n": 7 title: Zero trust architecture design principles publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles accessed: "2026-11-03" - "n": 8 title: Zero Trust Maturity Model publisher: CISA url: https://www.cisa.gov/zero-trust-maturity-model accessed: "2026-11-03" - "n": 9 title: User Account Management, Mitigation M1018 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/mitigations/M1018/ accessed: "2026-11-03" --- # Least privilege and Just-In-Time access Least privilege is a security principle: a system must limit the access rights of users, or of programs acting on their behalf, to the minimum needed to accomplish the assigned tasks [1]. An employee who only needs to read a folder should not be able to delete it. Just-In-Time access takes the idea further for elevated rights. Users receive temporary permissions to perform privileged tasks, and access is granted only at the moment they need it [2]. Once the time is up, the privileged access is removed automatically [3]. ## In 30 seconds - Where it happens: in any workstation or service where administrator rights exist, for example the administration of Microsoft 365 or of a corporate directory [2]. - What the attacker wants: to use an existing account and its rights, which sometimes spares them from using malware and makes their presence harder to spot [4]. - The reflex: ask for elevated access for a limited time with a clear reason, never lend your administrator rights, and report rights that are no longer used. - If it is already done: tell the IT department, which can remove rights that have become unnecessary during an access review [3]. ## Straight answers ### Why limit the rights of a trusted employee? Organizations limit the number of people who have access to sensitive resources to reduce two risks: that a malicious user gets at that data, and that an authorized user inadvertently affects a sensitive resource [2]. Microsoft adds that by limiting roles and scopes, the resources at risk are limited if the account is compromised [3]. ### What does "just-in-time" mean in practice? The employee has no permanent administrator right. They are "eligible" for a role and activate it when they have to perform a privileged task. Activation can require multifactor verification, a business justification, or the approval of a designated approver [2]. Once the role is activated, it stays usable for a predefined period, then the user must activate it again [2]. ### Does least privilege apply only to administrators? No. OWASP describes it as a rule to apply at every level: an accountant and a salesperson hold the same hierarchical rank, but do not need the same resources. The accountant should not access the customer database, nor the salesperson the payroll data [5]. ### What happens if an access request expires? According to Microsoft's documentation, when a role assignment nears its expiration, the user can request an extension. Once it has expired, they can request a renewal. Both requests go through approval by a global administrator or a privileged role administrator [2]. ## How it works The operation described here follows Microsoft's Privileged Identity Management tool, one example among others. An administrator assigns a role to a user, a group, or a service identity. The assignment specifies the scope (the role applies only to a given set of resources), its type (eligible or active), and its duration, with start and end dates or with no limit [2]. To activate an eligible role, the user chooses an activation duration within the limits set by the administrators and states the reason for the request [2]. The tool can require approval, enforce multifactor authentication, send notifications on activation, and keep an audit history [2]. MITRE also cites the ephemeral roles of other cloud providers for granting elevated permissions limited in time [6]. Microsoft recommends stacking several controls, because no single feature covers every case. Its example: a custom role limited to an administrative unit, so that a regional support administrator can only reset the passwords of their own region. Activation then goes through PIM, with approval, and conditional access then requires a compliant device and multifactor authentication [3]. The UK NCSC defines the "zero trust" approach this way: the trust inherent in the network is removed, the network is assumed to be hostile, and every request is verified against an access policy [7]. CISA associates with it least-privilege access decisions, made request by request [8]. ## What you do - Ask for access when you need it, with a duration suited to the task and a specific reason. The reason given at activation is used to understand why the role was used [2]. - Use the narrow role that matches the task. Microsoft advises against assigning broader roles or roles over larger scopes, even if they seem more convenient [3]. - Keep your administrator rights to yourself. A role activation is made by a user and triggers a notification, and the audit history keeps it [2]. OWASP notes that without proper logging, an access violation may remain impossible to attribute to an individual [5]. - If you change teams or assignments, ask for the rights of your former role to be removed. Microsoft notes that without auditing, people who change teams accumulate unnecessary access [3]. - Respond to access reviews: they serve to check that users still need their roles [2]. - Enable multifactor authentication on administration accounts. Microsoft states that, according to its studies, an account is 99.9% less likely to be compromised with it [3]. ## Pitfalls Accumulating rights. OWASP calls "privilege creep" the case where users' privileges exceed those defined at the outset. It recommends a periodic review, and points out that it is easier to add permissions than to remove them [5]. Permanent administration accounts. Permanent privileged access is what PIM aims to eliminate for users in a privileged role [3]. Microsoft recommends giving the global administrator role to fewer than five people and limiting privileged role assignments to fewer than 10, because these roles allow privilege escalation [3]. It provides one exception: two emergency access accounts, assigned permanently, not tied to individuals, and reserved for "break glass" situations [3]. Forgotten accounts. MITRE points out that adversaries may abuse inactive accounts, for example those of people who have left the organization, because the former holder is no longer there to notice abnormal activity [4]. MITRE also recommends disabling accounts after a period of inactivity (30 days as an example) and deleting accounts without an owner during audits [9]. Overpowered service accounts. Role assignments can target service principals or managed identities, just as they can people [2]. For administrators, Microsoft distinguishes three aspects of a role assignment: a specific set of permissions, over a specific scope, for a specific period [3]. The same credentials everywhere. MITRE is concerned about the overlap of permissions between local, domain, and cloud accounts: an adversary can move from one account to another up to a high level of access, such as domain administrator [4]. ## Real cases ### 2015: the attack on the Ukrainian power grid According to MITRE, during the 2015 attack on the Ukrainian power grid, the Sandworm Team group used valid accounts on the corporate network to elevate its privileges, move laterally, and establish a lasting presence there [4]. The source does not detail which rights these accounts held. ## Sources 1. NIST, "least privilege - Glossary | CSRC". https://csrc.nist.gov/glossary/term/least_privilege (accessed 3 November 2026) 2. Microsoft, "Qu’est-ce que Microsoft Entra Privileged Identity Management ?". https://learn.microsoft.com/fr-fr/entra/id-governance/privileged-identity-management/pim-configure (accessed 3 November 2026) 3. Microsoft, "Meilleures pratiques pour les rôles Microsoft Entra". https://learn.microsoft.com/fr-fr/entra/identity/role-based-access-control/best-practices (accessed 3 November 2026) 4. MITRE ATT&CK, "Valid Accounts, Technique T1078 - Enterprise". https://attack.mitre.org/techniques/T1078/ (accessed 3 November 2026) 5. OWASP, "Authorization - OWASP Cheat Sheet Series". https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html (accessed 3 November 2026) 6. MITRE ATT&CK, "Privileged Account Management, Mitigation M1026 - Enterprise". https://attack.mitre.org/mitigations/M1026/ (accessed 3 November 2026) 7. NCSC (UK), "Zero trust architecture design principles". https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles (accessed 3 November 2026) 8. CISA, "Zero Trust Maturity Model". https://www.cisa.gov/zero-trust-maturity-model (accessed 3 November 2026) 9. MITRE ATT&CK, "User Account Management, Mitigation M1018 - Enterprise". https://attack.mitre.org/mitigations/M1018/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.