Skip to content
IT Atlas

Identity · Privileged Access

Privileged Access Management

Controlling, brokering, recording and time limiting administrative access to the systems that can change everything else.

AdvancedUpdated 2026-09-01

Overview

Privileged access management combines account hygiene (separate admin identities, no standing membership), workflow (request, approve, activate), brokering (vaults, session proxies, jump hosts) and assurance (recording, monitoring, review).

The strategic goal is to remove standing privilege. If no account holds permanent high privilege, stolen credentials and dormant accounts lose most of their value to an attacker.

How it works

  1. 01Administrative identities are separate from daily use accounts and are never used to browse the web or read email.
  2. 02Just in time elevation grants a role for a bounded window with approval and justification, then revokes it automatically.
  3. 03Credentials for shared and service accounts are vaulted, rotated and injected into sessions rather than known by humans.
  4. 04Sessions to sensitive targets are proxied and recorded through a bastion or session manager.

Layer model

Tier 0, Control plane
Domain controllersIdentity providersPKIVirtualization managersBackup systemsSecurity tooling
Tier 1, Servers and applications
Server administratorsApplication administratorsDatabase administrators
Tier 2, Endpoints and support
Help deskEndpoint administratorsField support

Security considerations

  • Enforce phishing resistant MFA for every privileged activation.
  • Use privileged access workstations that are hardened, managed and restricted from general internet and email use.
  • Alert on privileged group changes, new role assignments and out of hours activation.
  • Conduct periodic access reviews and remove entitlements that are no longer justified.

Common misconfigurations

  • Help desk staff holding domain level rights so they can 'fix things faster'.
  • Service accounts in Domain Admins because an installer once required it.
  • Vaulting deployed but bypass paths, direct RDP or SSH, left open.
  • Break glass credentials stored in the same systems they are meant to recover.

Primary sources