Standing admin access is a risk decision your board didn’t know it made

If your school’s IT lead reads email and browses the web from the same account that holds domain admin rights, someone has already accepted a risk on the school’s behalf. The question is whether they meant to.

Restricting administrative privileges is one of the eight ASD mitigation strategies, and it’s consistently one of the cheapest to fix relative to how much breach risk it removes. A standing privileged account, one that’s active all day regardless of whether anyone’s using its privileges, is a permanent target. Phish the person holding it, and the attacker doesn’t need to escalate anything, they already have the keys.

Why this is a governance question, not just a configuration setting

In a lot of resource-constrained schools, the person with domain admin rights is also the person who fields help desk tickets, opens attachments from parents, and clicks links in supplier emails all day. That’s not a technical failure. It’s usually the direct result of a one-person or two-person IT team with no capacity to run separate accounts for separate purposes. The governance point is that this arrangement is a risk the school is carrying, whether or not anyone has named it as one. A board that has never been told “our most powerful account is also our most exposed one” hasn’t made an informed decision about it, they’ve inherited a default.

That’s worth surfacing explicitly, because the fix doesn’t require new headcount or new budget. It requires making the standing-access decision visible, and then removing it where it costs nothing to do so.

The free bit, and where it forks by licence

The Australian Cyber Security Centre’s Small Business Cloud Security Guide has a worked technical example for doing this in Microsoft Entra ID using Privileged Identity Management, PIM for short. Instead of an admin role being permanently active, the role becomes “eligible”: the user requests activation when they actually need it, approval and MFA are required to grant it, and the privilege expires after a set window. No standing target sits there all day waiting to be phished or keylogged.

Here’s the fork worth putting in front of a Business Manager before anyone promises this to the executive team: PIM has historically sat behind Microsoft Entra ID P2, or the Microsoft 365 E5 and A5 bundles that include it. It is not included in every education tenant, and it is unlikely to be included on A1 or standard A3 plans. Confirm your school’s actual licence SKU in the Entra admin centre before relying on the general impression of what “should” be included. A Business Manager who’s told “we’ve got that covered” deserves the specific licence tier as the answer, not a general assurance.

If PIM isn’t in your licence, the fallback still closes most of the gap for zero additional spend: separate standard and admin accounts for every privileged user, with MFA enforced on the admin account at minimum. It’s less elegant than time-limited eligible access, but it removes the everyday exposure of a powerful account being used for ordinary browsing and email.

Who this control does, and doesn’t, need to cover

This is one of the few controls in this series that doesn’t carry a student-versus-staff population fork, because students don’t hold administrative accounts in a properly configured school environment. The population that matters here is narrower: every account with domain admin, Global Admin, Intune admin, or equivalent elevated access, which in most schools is a short list. That narrowness is exactly why it’s a cheap fix. There’s no large cohort to manage exceptions for, no shared-device complications, just a small number of accounts that need a clear decision about how their privilege is granted.

Where this leaves you

None of this requires new capital expenditure, and most of it can be actioned inside a term. The test worth applying to your own environment: if you asked your IT lead today which accounts hold standing privileged access, and how long each has held it, would the answer come back in minutes, or would someone need to go looking?

Best Practice - This is the way