What Is Least Privilege?

Definition

Least privilege is the security principle that every user, device, application, and service account gets only the access it needs to do its job, and nothing more. NIST defines it as restricting "the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks."

How It Works

Least privilege applies to people and to software:

Separate admin accounts. Staff use a standard account for email and browsing, and a separate admin account only when they need to change settings.
Role-based access. Permissions follow job roles, so a new bookkeeper gets the finance folders, not the whole file server.
Just-in-time access. Admin rights are granted for a set time when requested, then removed automatically.
Scoped app permissions. Integrations and OAuth apps get only the mailboxes, files, or API scopes they need.
Regular review. Access is checked when people change roles or leave, because permissions tend to pile up.

The NSA and CISA include "improper separation of user/administrator privilege" in their 2023 list of the ten most common network misconfigurations, citing "excessive account privileges" and "privilege creep," which they describe as "the granting of excessive access and unnecessary account privileges" as organizations change. Their guidance is to "apply least privilege principles to user accounts and groups allowing only the performance of authorized actions."

Least privilege does not stop an attacker from getting in. It limits how far they get once inside.

Real-World Example

In January 2024, Microsoft disclosed that the Russian group Midnight Blizzard had used a password spray to compromise a legacy, non-production test tenant account that lacked MFA. From there, the actor found "a legacy test OAuth application that had elevated access to the Microsoft corporate environment," used it to grant itself the Exchange Online "full_access_as_app" role, "which allows access to mailboxes," and read corporate email. Microsoft's guidance afterward told defenders to audit privileges because "identities can often be granted privilege over and above what is required."

Why It Matters for a Small Business

In small offices, convenience wins: everyone is a local administrator, the owner's daily account is a global admin, and a former contractor still has full access to the shared drive. Each of those turns one stolen password or one infected laptop into a business-wide incident. Ransomware spreads further, and email-based fraud reaches more mailboxes, when ordinary accounts can do administrator things. Trimming access is one of the cheapest security improvements available, and it also makes audits, insurance questionnaires, and offboarding simpler.

How to Spot It / How DTS Handles It

Warning signs: daily accounts with admin rights, more than a few global admins in Microsoft 365, shared admin logins, apps with tenant-wide mail access nobody remembers approving, and departed staff still listed.

DTS can help with separating admin and daily accounts, reviewing admin roles and app consents, setting up role-based groups, and removing access during offboarding. See our managed IT service, or our Microsoft 365 security service.

Related Terms

Privileged access: the admin accounts least privilege limits.
Role-based access control: permissions by job role.
Just-in-time access: temporary admin rights.
Offboarding and access review: removing access that is no longer needed.
Service account: non-human accounts that need scoping too.
OAuth consent phishing: over-privileged apps as an attack path.
Zero trust: a model built on least privilege.
Password spraying: how Midnight Blizzard got its first foothold.

Sources

NIST CSRC Glossary, Least Privilege (from CNSSI 4009-2022 and NIST SP 800-12 Rev. 1): https://csrc.nist.gov/glossary/term/least_privilege
NSA and CISA, NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations, AA23-278A (October 5, 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
Microsoft Threat Intelligence, Midnight Blizzard: Guidance for responders on nation-state attack (January 25, 2024): https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/

Last updated October 14, 2026.