Privileged access management for SMBs

Global Admin, AWS root, Salesforce system admin — these are the accounts that cause the most damage when compromised. Here's what you can do without buying an expensive PAM tool.

Privileged Access Management (PAM) sounds like something for banks and governments. For SMBs, I'll put it plainly: which accounts, if compromised, could bring your entire business to its knees? In practice, that's 5 to 15 accounts — and they deserve special treatment.

Take stock of your privileged accounts

Work through this list:

• M365 / Entra Global Administrator(s)
• Google Workspace super admin
• AWS root user
• Accounting software admin (Exact, Moneybird, etc.)
• Salesforce system admin
• GitHub/GitLab org owner
• Domain registrar (TransIP, Hover, Namecheap)
• DNS provider (Cloudflare)
• Password manager admin
• Hosting control panel (Plesk, cPanel)
• Bank account ("authorised to make payments")

Write these down and record, for each account: who holds the credentials, which vault they're stored in, and who the backup person is. See also Setting up a SaaS inventory.

The three rules of privileged access

1. Not for day-to-day work. Your Global Admin sends emails and joins meetings using a regular user account. You only switch to the privileged account for admin tasks. We call these dedicated admin accounts.
2. MFA is mandatory, not optional. For regular users, MFA is strongly recommended — for privileged accounts, it's non-negotiable. Ideally, use a hardware token (YubiKey) for this set of accounts.
3. At least two people must know the root credentials. One person is a single point of failure. Three is too many. Two is the sweet spot.

Just-in-time access: the mature approach

In Entra ID you can configure PIM (Privileged Identity Management): Global Admin rights are NOT active by default — someone must activate them for a session of up to 8 hours, with approval from a colleague. This dramatically reduces your attack surface. See the M365 governance guide for the setup.

Review and rotation

Every quarter: go through the privileged accounts list. Two questions per entry: "does this person still need this?" and "when was it last used?" Bear in mind: if a Global Admin hasn't logged in for 95 days, that's a risk (see access review).

Of all the categories in your access management practice, this is the one with the fewest accounts but the most attention required. That's exactly how it should be.