Least privilege

The principle of least privilege limits the damage any single compromised account can do. A help desk technician needs to reset passwords, not to read every mailbox. A backup service needs to read files, not to log in interactively. An administrator needs elevated rights while doing admin work, not while reading email.

In practice, least privilege shows up as several habits: separate admin accounts from daily accounts, role-based instead of individual permissions, just-in-time elevation that expires automatically (for example Microsoft Entra Privileged Identity Management), regular access reviews, and removing access when people change roles or leave.

Example

A marketing employee's account is phished. Because the account has only the access marketing needs, the attacker can read that user's mail and a few shared folders. If the same person had been made a local administrator on every workstation "to make support easier", the attacker could have dumped credentials and moved across the network within hours.

Why it matters for a SOC analyst

During an investigation, the permissions of the compromised account decide how severe the incident is and how wide the scope must be. Afterwards, excessive privilege is one of the most common root causes you will document. Flag it in your report: a standing Global Administrator role or a service account in Domain Admins is a finding worth fixing even when nothing bad happened yet.