[{"data":1,"prerenderedAt":143},["ShallowReactive",2],{"publication:en:P137":3},{"meta":4,"copy":16,"relatedArticles":129,"terms":130,"term":131,"resourceParent":137,"glossaryParent":140},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P137","\u002Fglossary\u002Fleast-privilege","term","what is least privilege","What is least privilege? Access matched to the job","What is least privilege? Permissions and limits","Understand least privilege through identity, task, scope and duration. Learn why MFA, role names or fewer administrators alone do not prove appropriate access.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fservices\u002Fdigital-security","2026-10-30",{"intro":17,"sections":18,"checklistTitle":87,"checklist":88,"faq":96,"sources":106,"links":109,"cta":124},"Least privilege means giving a person, application or process only the access needed for an approved task, within the appropriate scope and time. It is an authorization principle: it concerns what an identity can do after access is granted. A strong sign-in method helps protect the identity but does not make excessive permissions appropriate.",[19,28,64,69,74,82],{"title":20,"paragraphs":21,"sources":24},"Describe the job before choosing a role",[22,23],"Start with an action the business has approved: publish an article, reconcile an order, manage a mailbox or maintain one website. Identify the system, data and environment needed for that action. A job title such as developer or office manager is too broad to establish whether a person needs payment settings, customer exports or organization-wide administration.","The NCSC NZ guidance describes least privilege across people, applications and processes. For a small business, a useful working record is the approved task, required capability, owner and review point. The record explains why access exists. It also helps separate a permanent requirement from a one-off task that finished months ago.",[25],{"label":26,"url":27},"NCSC NZ: least-privilege principles and access review","https:\u002F\u002Fwww.ncsc.govt.nz\u002Fprotect-your-organisation\u002Fleast-privilege\u002F",{"title":29,"paragraphs":30,"sources":33,"table":37},"Read permissions, scope and duration together",[31,32],"A permission describes an allowed action; scope identifies where it applies; duration identifies how long it is needed. Reading a project report is different from exporting all company records. Editing one website is different from administering every customer account. A narrowly named role can still be broad when assigned across an entire organization or inherited through a group.","Microsoft Entra role guidance explicitly considers permissions, scope and time. Its available controls belong to that platform and may depend on the subscription. The wider decision remains useful elsewhere: compare the actual capability with the approved job, then choose a supported narrower arrangement where possible. Record an exception when the platform cannot express the boundary you need.",[34],{"label":35,"url":36},"Microsoft Entra: least privilege, role scope and review","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fbest-practices",{"caption":38,"headers":39,"rows":43},"Four questions behind an access assignment",[40,41,42],"Dimension","Business question","Evidence to retain",[44,48,52,56,60],[45,46,47],"Identity","Which person or application uses the access?","Named owner and account or service identity.",[49,50,51],"Action","What must that identity be able to do?","Approved task and effective permissions.",[53,54,55],"Scope","Which assets or records are necessary?","Specific site, project, tenant or data boundary.",[57,58,59],"Duration","When should the access end or be reviewed?","Expiry or review owner and date.",[61,62,63],"Exception","What cannot yet be narrowed safely?","Reason, compensating control and next decision.",{"title":65,"paragraphs":66},"Distinguish authentication from authorization",[67,68],"Authentication establishes a basis for trusting a sign-in; authorization decides the permitted actions. MFA or a passkey can strengthen authentication while the signed-in account still has unnecessary administrative powers. Conversely, limiting permissions does not make a weak or compromised login safe. Review both questions rather than treating one product setting as a substitute for the other.","The distinction matters during a supplier review. A contractor may use a well-protected account but still control all hosting subscriptions when only one site is in scope. Ask which capability is needed and how it is verified. Do not use a successful login as evidence that every subsequent action is appropriate, or a denied login as a complete test of application permissions.",{"title":70,"paragraphs":71},"Include inherited access, automation and recovery owners",[72,73],"Effective access can come from direct assignments, groups, shared credentials, delegated administration and application permissions. An account removed from a visible staff list may retain a separate route through an integration or supplier console. A single screenshot of one role page is a starting observation, not a full account of every effective privilege.","Inventory automation and recovery alongside staff. A backup job, mail integration or deployment task needs an accountable owner even if nobody signs in manually. Protect the business's recovery route before removing broad access. Least privilege should preserve authorized work and recovery; disabling the only administrator is an outage, not a successful access review.",{"title":75,"paragraphs":76,"example":79},"Check allowed work and an agreed restricted action",[77,78],"A useful access test checks both sides of the intended boundary. Confirm that the approved task still works, then check a harmless, explicitly authorized action that should be unavailable. Use synthetic records or a test environment when an action could reveal customer data or alter operations. Record the identity, scope and conditions so the result can be understood later.","A successful test supports the tested path. It does not prove that every inherited role, cached session or alternative application route is restricted. If a result differs from the expectation, pause the rollout and investigate the effective access. Do not remove additional permissions at random until the workflow happens to work.",{"title":80,"text":81},"Illustrative publishing-role boundary","A content editor can update an approved draft but cannot change the payment destination in a controlled test. That supports the tested separation. Hosting access, plugin installation and other accounts still need their own review.",{"title":83,"paragraphs":84},"Keep the boundary current as the business changes",[85,86],"Review access when duties change, a supplier finishes work, a new application is connected or an incident exposes an unexpected capability. Keep the approved task and exception record beside the review result. A permanent administrator assignment should have a current reason, and a temporary assignment should not depend on everyone remembering to remove it informally.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide, specializing in websites and digital infrastructure. Our practical Israeli technical knowledge connects account permissions with the work the business needs to perform. We agree which systems and access routes to review, the supported changes and the business checks needed for handover.","Questions for a least-privilege discussion",[89,90,91,92,93,94,95],"Approved business task identified","Person, supplier or application identity named","Effective actions and scope reviewed","Inherited and shared access considered","Duration or review owner recorded","Authorized recovery retained","Useful work and a safe restricted action checked",[97,100,103],{"question":98,"answer":99},"Is least privilege the same as MFA?","No, MFA concerns how an account authenticates. Least privilege concerns what the account can do. A business needs suitable controls for both sign-in and permissions; a strong authentication method does not justify unnecessary access.",{"question":101,"answer":102},"Does least privilege mean nobody can be an administrator?","No, some tasks need administration. Identify who needs it, which assets are in scope and when it is required. Where the platform supports a narrower or temporary role, evaluate it while preserving an approved recovery route.",{"question":104,"answer":105},"Can a role name prove the account has limited access?","No: review effective permissions, scope, inheritance and other access routes. Role names differ between products. Test the intended business task and an appropriate restricted action under agreed conditions, then document the limits of that test.",[107,108],{"label":26,"url":27},{"label":35,"url":36},[110,113,115,118,121],{"path":111,"label":112},"\u002Fblog\u002Fleast-privilege-small-business","Run a small-business access review",{"path":13,"label":114},"Scope an account and permissions review",{"path":116,"label":117},"\u002Fglossary\u002Fmfa","Understand multifactor authentication",{"path":119,"label":120},"\u002Fblog\u002Femployee-offboarding-access","Remove access during an employee departure",{"path":122,"label":123},"\u002Fblog\u002Fbackup-access-separation","Review the permissions controlling backups",{"title":125,"description":126,"button":127,"type":128},"Match access to the work your business needs","Describe the system, current owner and task. We can clarify the scope and acceptance checks before changing permissions.","Discuss an access review","check",[],[],{"name":132,"aliases":133},"Least privilege",[134,135,136],"principle of least privilege","PoLP","minimum permissions",{"path":138,"label":139},"\u002Fresources","Website security resources and templates",{"path":141,"label":142},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134057732]