Cyberpediaby Brain
ENDEFR

Least privilege and Just-In-Time access

Least privilege limits rights to what is strictly needed, Just-In-Time access grants them for a limited time. What employees do.

In 30 seconds

Where it happens
In any workstation or service where administrator rights exist, for example the administration of Microsoft 365 or of a corporate directory2.
What the attacker wants
To use an existing account and its rights, which sometimes spares them from using malware and makes their presence harder to spot4.
The reflex
Ask for elevated access for a limited time with a clear reason, never lend your administrator rights, and report rights that are no longer used.
If it is already done
Tell the IT department, which can remove rights that have become unnecessary during an access review3.

What it is

Least privilege is a security principle: a system must limit the access rights of users, or of programs acting on their behalf, to the minimum needed to accomplish the assigned tasks1. An employee who only needs to read a folder should not be able to delete it.

Just-In-Time access takes the idea further for elevated rights. Users receive temporary permissions to perform privileged tasks, and access is granted only at the moment they need it2. Once the time is up, the privileged access is removed automatically3.

Straight answers

Why limit the rights of a trusted employee?

Organizations limit the number of people who have access to sensitive resources to reduce two risks: that a malicious user gets at that data, and that an authorized user inadvertently affects a sensitive resource2. Microsoft adds that by limiting roles and scopes, the resources at risk are limited if the account is compromised3.

What does "just-in-time" mean in practice?

The employee has no permanent administrator right. They are "eligible" for a role and activate it when they have to perform a privileged task. Activation can require multifactor verification, a business justification, or the approval of a designated approver2. Once the role is activated, it stays usable for a predefined period, then the user must activate it again2.

Does least privilege apply only to administrators?

No. OWASP describes it as a rule to apply at every level: an accountant and a salesperson hold the same hierarchical rank, but do not need the same resources. The accountant should not access the customer database, nor the salesperson the payroll data5.

What happens if an access request expires?

According to Microsoft's documentation, when a role assignment nears its expiration, the user can request an extension. Once it has expired, they can request a renewal. Both requests go through approval by a global administrator or a privileged role administrator2.

1How it works1 min

The operation described here follows Microsoft's Privileged Identity Management tool, one example among others. An administrator assigns a role to a user, a group, or a service identity. The assignment specifies the scope (the role applies only to a given set of resources), its type (eligible or active), and its duration, with start and end dates or with no limit2.

To activate an eligible role, the user chooses an activation duration within the limits set by the administrators and states the reason for the request2. The tool can require approval, enforce multifactor authentication, send notifications on activation, and keep an audit history2. MITRE also cites the ephemeral roles of other cloud providers for granting elevated permissions limited in time6.

Microsoft recommends stacking several controls, because no single feature covers every case. Its example: a custom role limited to an administrative unit, so that a regional support administrator can only reset the passwords of their own region. Activation then goes through PIM, with approval, and conditional access then requires a compliant device and multifactor authentication3.

The UK NCSC defines the "zero trust" approach this way: the trust inherent in the network is removed, the network is assumed to be hostile, and every request is verified against an access policy7. CISA associates with it least-privilege access decisions, made request by request8.

2What you do1 min
  • Ask for access when you need it, with a duration suited to the task and a specific reason. The reason given at activation is used to understand why the role was used2.
  • Use the narrow role that matches the task. Microsoft advises against assigning broader roles or roles over larger scopes, even if they seem more convenient3.
  • Keep your administrator rights to yourself. A role activation is made by a user and triggers a notification, and the audit history keeps it2. OWASP notes that without proper logging, an access violation may remain impossible to attribute to an individual5.
  • If you change teams or assignments, ask for the rights of your former role to be removed. Microsoft notes that without auditing, people who change teams accumulate unnecessary access3.
  • Respond to access reviews: they serve to check that users still need their roles2.
  • Enable multifactor authentication on administration accounts. Microsoft states that, according to its studies, an account is 99.9% less likely to be compromised with it3.
3Pitfalls2 min

Accumulating rights. OWASP calls "privilege creep" the case where users' privileges exceed those defined at the outset. It recommends a periodic review, and points out that it is easier to add permissions than to remove them5.

Permanent administration accounts. Permanent privileged access is what PIM aims to eliminate for users in a privileged role3. Microsoft recommends giving the global administrator role to fewer than five people and limiting privileged role assignments to fewer than 10, because these roles allow privilege escalation3. It provides one exception: two emergency access accounts, assigned permanently, not tied to individuals, and reserved for "break glass" situations3.

Forgotten accounts. MITRE points out that adversaries may abuse inactive accounts, for example those of people who have left the organization, because the former holder is no longer there to notice abnormal activity4. MITRE also recommends disabling accounts after a period of inactivity (30 days as an example) and deleting accounts without an owner during audits9.

Overpowered service accounts. Role assignments can target service principals or managed identities, just as they can people2. For administrators, Microsoft distinguishes three aspects of a role assignment: a specific set of permissions, over a specific scope, for a specific period3.

The same credentials everywhere. MITRE is concerned about the overlap of permissions between local, domain, and cloud accounts: an adversary can move from one account to another up to a high level of access, such as domain administrator4.

4Real cases1 min

2015: the attack on the Ukrainian power grid

According to MITRE, during the 2015 attack on the Ukrainian power grid, the Sandworm Team group used valid accounts on the corporate network to elevate its privileges, move laterally, and establish a lasting presence there4. The source does not detail which rights these accounts held.

Fact sheet

Identifier
CP-197
Wing
3. Protocols and defence
Brain skill
Controlling Access (control_access)
Brain reflex
cr-029
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
9 sources checked on 3 November 2026
Sources9 sources
  1. NIST, “least privilege - Glossary | CSRC”. https://csrc.nist.gov/glossary/term/least_privilege (accessed 3 November 2026)
  2. Microsoft, “Qu’est-ce que Microsoft Entra Privileged Identity Management ?”. https://learn.microsoft.com/fr-fr/entra/id-governance/privileged-identity-management/pim-configure (accessed 3 November 2026)
  3. Microsoft, “Meilleures pratiques pour les rôles Microsoft Entra”. https://learn.microsoft.com/fr-fr/entra/identity/role-based-access-control/best-practices (accessed 3 November 2026)
  4. MITRE ATT&CK, “Valid Accounts, Technique T1078 - Enterprise”. https://attack.mitre.org/techniques/T1078/ (accessed 3 November 2026)
  5. OWASP, “Authorization - OWASP Cheat Sheet Series”. https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html (accessed 3 November 2026)
  6. MITRE ATT&CK, “Privileged Account Management, Mitigation M1026 - Enterprise”. https://attack.mitre.org/mitigations/M1026/ (accessed 3 November 2026)
  7. NCSC (UK), “Zero trust architecture design principles”. https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles (accessed 3 November 2026)
  8. CISA, “Zero Trust Maturity Model”. https://www.cisa.gov/zero-trust-maturity-model (accessed 3 November 2026)
  9. MITRE ATT&CK, “User Account Management, Mitigation M1018 - Enterprise”. https://attack.mitre.org/mitigations/M1018/ (accessed 3 November 2026)

Cite this article

Brain, “Least privilege and Just-In-Time access”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/

BibTeX 
@misc{brain_cp197_en_2026,
  author = {Brain},
  title = {Least privilege and Just-In-Time access},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/least-privilege-just-in-time-access/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence