Least Privilege

Identify your privileged accounts before anything else.

Objective [a] is a list, and every environment has entries for it because somebody runs the IT. Claiming there are no privileged accounts earns a Not Met. You may define the category narrowly, domain admins and global administrators for example, but the list must exist, be written down, and match reality.

Give every administrator two accounts.

A daily account with no elevation and a separate admin account used only for administrative work is the pattern that answers [b] at any size. In a three-person company, two accounts per administrator is enough. A third tier adds ceremony without adding compliance.

Objective [c] wants your security functions named.

Establishing accounts, configuring access authorizations, setting events to be logged, and tuning intrusion detection are the guide's examples. List which of these exist in your environment and which roles reach them. Objective [d] then follows: restrict each function to the few people whose job requires it, and record that authorization.

Stop using the highest privilege for everything.

Running routine endpoint work with a domain admin account is the principle of most privilege, and one piece of malware in that session reaches everything the account reaches. Scope the credential to the task. Use a local admin credential for endpoint installs and narrow Microsoft Entra ID roles instead of Global Administrator. Where the platform offers it, use Privileged Identity Management, which grants admin rights just in time and takes them back after.