Privileged access management
An administrator account is the most valuable thing an attacker can steal, because it opens everything else. Privileged access management limits who holds that power, for how long, from which device, and records what they did with it.
What we do
- Admin account inventory and cleanup
- Removal of standing privileges
- Approval and time limits for elevation
- Session recording and review
- Service account and secret rotation
- Break-glass design and testing
- Audit evidence for examiners and insurers
We work with vaulting and session tools from vendors such as Delinea and CyberArk, with Microsoft Entra Privileged Identity Management for time-limited, approved role activation, and with the privileged access workstation model Microsoft documents, where administration happens only from a hardened device. Our team also separates everyday and administrator accounts, removes standing domain admin rights and sets up break-glass accounts that are locked away and alerted on.
This group links to our Cybersecurity practice and to Microsoft Exchange and Active Directory. Access limits only help if they are used, so we also review how people actually sign in before and after the change. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Delinea
- CyberArk
- BeyondTrust
- Microsoft Entra Privileged Identity Management
Platforms and practices
- Credential vaulting and rotation
- Just-in-time role activation
- Privileged session recording
- Privileged access workstations
- Separate admin and everyday accounts
- Tiered administration model for Active Directory
- Break-glass emergency accounts with alerts
- Service account inventory
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Privileged access management for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreMicrosoft Exchange, Active Directory & SQL
Exchange, Active Directory and SQL Server built redundant, backed up and recoverable, and engineers on call when they fail.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhy not just give administrators strong passwords?
Passwords are stolen, reused and phished, and a standing administrator account is always available to the attacker who steals it. Privileged access management shortens that window: rights are requested for a task, approved, time-limited and recorded. Administration happens from a hardened device with phishing-resistant multi-factor authentication, so one stolen password is not enough.
What is a break-glass account?
It is an emergency administrator account kept for the day normal sign-in fails, for example when the multi-factor service or the identity provider is down. It has a long random password stored offline, it is excluded from the policies that could lock it out, and every use triggers an alert. It is tested on a schedule and never used for daily work.
Does this apply to a small company?
Yes, in a lighter form. Even with a handful of staff, separate everyday and administrator accounts, remove permanent global administrator rights where possible, require multi-factor authentication for admin roles and keep two break-glass accounts. A full vaulting product is justified when many people or vendors share access to many systems.
How do you handle vendors and contractors who need administrator access?
Give each person a named, individual account instead of a shared login, limit it to the systems and the hours of the job, and remove it at the end. Where the risk justifies it, route the session through a gateway that records it. Shared vendor passwords are what this approach removes.