Privileged access

Who can change your systems? Most businesses can't answer that in one list.

Admin access spreads quietly: an old Global Admin, a supplier's always-on remote tool, a service account nobody owns, and now AI agents. Privileged access management finds it, cuts it back and puts time limits on the rest. Here is how, and a nine-point check for your business.

Microsoft details from Microsoft Learn; Australian guidance from ASD. Checked 31 October 2026.

Book an access review Check your admin access 07 3114 2808

PAM versus PIM
Emergency access done right
Nine-point check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

An IT manager checks an access list on a tablet while a colleague points to equipment in an open network cabinet. — **Access for the task**Admin roles granted for the job at hand, then they expire.

Beyond the admin list

Privileged access lives in four places.

An account is privileged when it can change or bypass a security control, whatever it is called.

People and directory roles

Global Admins, plus the many narrower roles that still change security.

Separate accounts
Specific roles
Eligible, not permanent

Privileged access check

How tight is admin access in your business?

Tick what is true today. You get the gaps in the order we would close them.

Tick what is true for your business today.

A list of every privileged account, with an ownerPeople, suppliers, service accounts and AI agents, and what each can change.
Admins use a separate admin accountNever the account they read email and browse with.
Specific roles instead of Global AdminLicence, Exchange or Intune admin for the task at hand.
Phishing-resistant sign-in for adminsPasskeys or security keys, enforced by policy.
Staff are not local admins on their laptopsLocal admin passwords managed by Windows LAPS where used.
Supplier access is on request and expiresNamed people, a reason, and removal when the job ends.
Two tested emergency access accountsCloud only, kept outside the approval chain, alerts on any use.
Service accounts and agents have owners and limitsLeast permissions, no interactive sign-in, credentials rotated safely.
Access reviewed at least quarterlyRemovals after departures and role changes, exceptions recorded.

Where you stand

0of 9 controls in place

9 gaps to close.

A list of every privileged account, with an ownerYou cannot protect access you have not found.
Admins use a separate admin accountOne phishing email should not reach admin rights.
Specific roles instead of Global AdminMost admin work does not need the keys to everything.
Phishing-resistant sign-in for adminsAdmin accounts are the first target of fake sign-in pages.
Staff are not local admins on their laptopsLocal admin lets malware and users switch protections off.
Supplier access is on request and expiresAlways-on remote support is a common way in.
Two tested emergency access accountsA locked-out tenant with no recovery path is its own incident.
Service accounts and agents have owners and limitsNon-human accounts often hold broad, forgotten access.
Access reviewed at least quarterlyPrivilege grows quietly unless someone prunes it.

Close the gaps

Different tools

PIM governs roles. PAM covers everything with privilege.

Control	What it covers	What it does not
PAM practice	Ownership, least privilege, approval, evidence across all systems	Enforces nothing without implementation
Microsoft Entra PIM	Time-limited activation of Entra roles, Azure roles and supported groups	Service passwords, local admins, session recording
Windows LAPS	Manages the local admin password on supported Windows devices	Who else is a local admin
Vaulting and session tools	Stored secrets and recorded admin sessions, where supported	Coverage depends on the product and integrations

PIM needs Entra ID P2 or Entra ID Governance. Business Premium includes Entra ID P1 only.

Access for the task

Grant the role for the job, then check it expired.

Request a specific roleThe narrowest role that does the job, with the reason recorded.
Verify the sign-inPhishing-resistant MFA and a managed device for activation.
Approve the sensitive onesA second person for high-impact roles, with a fallback if they are away.
Check expiry and changesThe role lapses, but changes made while active stay. Review them.

Break-glass

Keep emergency access outside the normal chain.

Microsoft recommends two or more cloud-only emergency access accounts with permanently active Global Admin.

Separate dependenciesNot tied to federation, a staff member's phone or the approval process.
Protected sign-inPasskeys or security keys, kept safe with named custodians.
Alert on any useSomeone is told immediately if an emergency account signs in.
Tested recoveryProven before admin roles change, and after major policy changes.

What applies

Where ASD guidance lands.

Source	What it says	Evidence to keep
Essential Eight	Restrict administrative privileges; just-in-time admin at Maturity Level Three	Approved requests, separate accounts, reviews and logs
ISM, September 2026	Each AI agent gets a unique identity and sits in an agent register	Agent register with owner, purpose and permissions
APRA CPS 234	For entities in scope, controls matched to threats and asset sensitivity	Documented scope, control design and testing

The ISM is security guidance, not a law every business must follow. Check what your contracts, insurer and regulator require.

Our view

Start with the register. Everything else depends on it.

In most reviews we find more privileged accounts than the business expected: former staff, suppliers' tools and service accounts with Global Admin. Listing them, with an owner for each, is the step that makes every other control possible.

Then separate admin accounts, specific roles and phishing-resistant sign-in. Just-in-time roles come after that, once the emergency access path is proven. We never remove the last working way back in.

The order

Tightening privileged access in five steps.

Step 1Build the register
Every privileged person, supplier, service and agent.
Step 2Separate and narrow
Admin-only accounts and specific roles.
Step 3Secure emergency access
Two tested break-glass accounts.
Step 4Add time limits
Eligible roles with activation and approval.
Step 5Review and watch
Quarterly reviews, alerts on role changes.

Related guides

Admin access in context. Sign-in, detection, baseline.

The controls that sit around privileged access.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about privileged access.

What is privileged access management?

Controlling who and what can change your systems or security settings: finding every privileged account, giving each only the access it needs, protecting how it signs in, approving and time-limiting elevated access, and keeping evidence of what was done.

What is the difference between PAM and Microsoft Entra PIM?

PAM is the whole practice. PIM is one Microsoft service within it that makes Entra and Azure roles eligible rather than permanent, with activation, approval and expiry. PIM does not vault service passwords, manage local admin accounts or record remote sessions.

Does Business Premium include PIM?

No. Business Premium includes Entra ID P1. PIM needs Entra ID P2 or Entra ID Governance, which come with Microsoft 365 E5 or the Defender Suite for Business Premium, or as add-ons.

Should every Global Admin be time-limited?

No. Microsoft recommends two or more cloud-only emergency access accounts with permanently active Global Admin, protected by passkeys or security keys and monitored. Everyday admins can use eligible roles that are activated when needed.

Does the Essential Eight require just-in-time admin?

At Maturity Level Three. Lower levels focus on validating privileged access, separating admin accounts and environments, and limiting what privileged accounts can do, such as reading email or browsing the web.

What about AI agents with admin access?

ASD's September 2026 ISM update treats AI agents as their own identities: each needs a unique identity, an owner and an entry in an agent register, with only the permissions its task needs.

Next step

Start with an accurate admin access register.

We find every privileged account in scope, agree owners and roles with you, secure emergency access, then add time limits. Bring your system list and admin tasks, never passwords.

Book an access review 07 3114 2808