The Principle of Least Privilege: How to Apply It With an Access Review

Ask most small businesses who can see the payroll folder, and you’ll get a pause. Maybe finance. Probably the owner. Possibly the intern from 2 summers ago, a contractor, and anyone who has a link that was shared “with everyone in the company” to make a deadline.

That gap between who should have access and who actually does is what the principle of least privilege fixes. It’s one of the oldest ideas in security, and one of the most practical. It also matters more now that AI assistants can search everything a user has access to.

This guide explains what least privilege means and walks through a step-by-step access review for shared drives, SaaS apps and admin rights.

What the principle of least privilege means

NIST defines least privilege as a security principle that limits the access of users, or processes acting on their behalf, to the minimum necessary to do their assigned tasks. In practice, that means:

• People get access to what their role requires, not everything that might be handy someday.
• Apps, integrations and service accounts get only the permissions they need to work.
• Admin rights are rare, separate from everyday accounts and ideally temporary.
• Access is removed when people change roles or leave.

Least privilege is a building block of zero trust security and a core goal of identity and access management.

Why least privilege matters

Excess access doesn’t usually cause problems on its own. It becomes a problem the moment something goes wrong:

• A phished account can only reach what that user can reach. Less access means a smaller breach.
• Ransomware spreads using the permissions of the infected account. Admin rights let it spread everywhere.
• Mistakes like deleting a shared folder or emailing the wrong file are less damaging when fewer people can touch sensitive data.
• AI assistants that search company files can surface anything a user has permission to see, including overshared documents nobody remembered existed. Our guide on whether it’s safe to put company data into AI covers this risk.

The NSA and CISA’s 2023 advisory on the top 10 network misconfigurations lists improper separation of user and admin privilege and insufficient access controls on network shares among the most common problems they find. It specifically warns about “privilege creep,” where people accumulate access over time as they change roles.

Key takeaway: Least privilege isn’t about distrusting your team. It’s about limiting how far a single stolen password, infected laptop or honest mistake can reach.

Before you start: set up the review

A good access review needs a little preparation.

1. Pick an owner. Someone needs to run the review, usually IT, operations or the security lead.
2. Choose a scope. For a first pass, focus on 3 areas: shared drives and file storage, your top 10 SaaS apps and admin rights.
3. Identify data owners. Each department head should confirm who in their area needs access to what. IT shouldn’t guess.
4. Use a simple tracker. A spreadsheet with columns for system, user, access level, business reason, owner decision and date is enough.

Step-by-step access review

Step 1: Inventory your systems and accounts

List every system that holds company data: file storage, email, CRM, accounting, payroll, HR, project tools, code repositories and cloud consoles. If you use single sign-on, your SSO dashboard is a good starting list. Then export the user list from each system.

Step 2: Remove accounts that shouldn’t exist

Compare each system’s user list against your current employee and contractor roster. Disable accounts for people who’ve left, and investigate any account you can’t match to a person. Dormant accounts are easy targets. Use an offboarding checklist so this doesn’t keep happening.

Step 3: Review shared drives and file sharing

File storage is where oversharing hides. Look for:

• Organization-wide links, such as files shared with “anyone in the company.”
• Public or “anyone with the link” sharing, especially on sensitive folders.
• External sharing with personal email addresses or former partners.
• Individual permissions granted file by file instead of through groups.

The major platforms include tools for this. Google Workspace admins can filter Drive log events in the audit and investigation tool to find files shared externally. In Microsoft 365, SharePoint’s data access governance reports can identify sites and files shared with “Everyone except external users” and sharing links, though Microsoft says these reports require SharePoint Advanced Management licensing. See our checklists for Google Workspace security and securing Microsoft 365.

Step 4: Review SaaS app roles

For each important app, check user roles, not just whether someone has an account. Common findings include too many people with “admin” or “owner” roles, everyone on the most powerful plan tier by default and former managers who kept approval rights.

Also review connected apps and integrations. Third-party tools connected through OAuth often request broad permissions like “read all files” or “send email as you.” Remove ones nobody uses and question any that ask for more than they need.

Step 5: Review admin rights

Admin access deserves the closest look:

• Count your global or super admins. Most small organizations need only a few.
• Make sure admins use a separate admin account for admin tasks and a standard account for email and browsing.
• Remove local admin rights on laptops for people who don’t need them.
• Check service accounts and API keys for excessive permissions.

Our guide to privileged access management covers vaulting, just-in-time access and other controls for admin accounts.

Step 6: Have owners approve or revoke

Send each data owner a list of who has access to their systems or folders. Ask them to mark each line “keep,” “reduce” or “remove,” with a reason for anything sensitive. Then make the changes and record what changed.

Step 7: Fix the structure, not just the symptoms

One-time cleanups decay fast. To keep access tidy:

• Grant access through groups or roles (for example, “Finance team”) rather than to individuals.
• Set sharing defaults so new files are private or limited to the team by default.
• Automate joiners, movers and leavers through your HR system or SSO where possible.
• Use time-limited access for contractors and temporary projects.

Step 8: Schedule the next review

NIST SP 800-53 includes a control (AC-6(7)) for reviewing assigned privileges at an organization-defined frequency and removing those no longer needed. Pick a schedule that fits your risk.

Suggested access review schedule

These are practical starting points, not regulatory requirements. If you’re subject to a framework like SOC 2, HIPAA or PCI DSS, check its specific expectations.

Common mistakes to avoid

• Making least privilege so strict people can’t work. If getting access takes a week, people will share passwords or files through personal accounts. Make requests quick.
• Reviewing accounts but not permissions. An active employee with owner rights everywhere is still a problem.
• Forgetting non-human identities. Service accounts, API keys and integrations often hold the broadest access.
• Doing it once. Privilege creep starts again the day after cleanup.

Conclusion

The principle of least privilege is simple to state and easy to neglect. Start with a focused review of shared drives, your most important SaaS apps and admin rights. Remove what isn’t needed, move access to groups and roles, and put the next review on the calendar. These steps also cover several account and access safeguards in CIS Controls Implementation Group 1, so the effort pays off across your whole security program.

Sources

• NIST CSRC Glossary: Least privilege — definition of least privilege
• NIST SP 800-53 Rev. 5 — AC-6 least privilege and AC-6(7) review of user privileges
• NSA and CISA: Top Ten Cybersecurity Misconfigurations (AA23-278A) — privilege separation, privilege creep and share permissions
• Google Workspace Admin Help: Drive log events — auditing Drive sharing
• Microsoft Learn: Data access governance reports for SharePoint sites — finding overshared SharePoint content