Boost your cyber security: Admin accounts and privileged access
Every business owner knows admin accounts are powerful. But do you use separate accounts for your day-to-day work versus managing your Microsoft 365 or Google Workspace environment? This simple separation of duties is a fundamental step in improving your cyber security posture, especially for an Australian small business. Let's look at why it's so important.
Why should you separate daily-driver logins from privileged access?
Separating your daily-driver accounts from privileged admin accounts significantly reduces your exposure to cyber threats. If your regular user account, which you use for emails and browsing, gets compromised, hackers won't immediately gain control over your entire IT infrastructure. This best practice helps to contain damage and makes it harder for attackers to escalate their privileges. Think of it as having your house keys separate from your safe keys; you only use the safe keys when absolutely necessary.
How does using separate admin accounts improve cyber security?
Using separate admin accounts improves cyber security by limiting the attack surface and reducing the impact of a breach. When you need to perform administrative tasks, you log in with a distinct admin account, often with stronger authentication requirements. This minimises the time your powerful admin credentials are in active use and reduces the chances of them being stolen through phishing or malware. It's a key recommendation from cyber security experts, including the Australian Signals Directorate. You can book a free 15-minute audit chat to discuss your setup.
What are the Essential Eight requirements for privileged accounts?
The Essential Eight framework strongly recommends strict controls over privileged user accounts, especially separating them from standard user accounts. This practice forms a core part of their Maturity Level One for application whitelisting, limiting administrative privileges, and patching operating systems. By separating these accounts, you’re making it much harder for cybercriminals to compromise your systems. It’s not just about convenience; it’s about foundational cyber hygiene that protects your business assets.
How do you implement this in Microsoft 365 and Google Workspace?
In both Microsoft 365 and Google Workspace, you implement this by assigning administrative roles to dedicated user accounts. For Microsoft 365, create a separate user for each administrator that only has the necessary admin roles. Similarly, in Google Workspace, assign administrator roles to specific, separate user accounts designed solely for management tasks. Make sure these dedicated admin accounts have unique, strong passwords and multi-factor authentication enabled. We can help you check if your accounts are set up correctly. Let's chat.
What if an employee with admin rights leaves the company?
If an employee with admin rights leaves, it's crucial to immediately revoke their administrative access and disable their dedicated admin account. Don't just remove their standard user access; ensure their privileged access is also completely turned off or reassigned. This prevents unauthorised access post-employment and is a critical part of your offboarding process for both Microsoft 365 and Google Workspace environments. Failing to do so can leave significant security gaps.
Separating your daily-driver logins from privileged admin accounts is a non-negotiable step for any Australian small business serious about cyber security. It's a simple, effective measure that dramatically reduces your risk.
Frequently asked questions
- What is privileged access in cyber security?
- Privileged access refers to the elevated permissions granted to certain user accounts that allow them to perform critical system administration tasks, such as creating new users, changing security settings, or installing software. These accounts have more power and control over your IT environment than standard user accounts.
- Why is multi-factor authentication (MFA) important for admin accounts?
- Multi-factor authentication (MFA) is crucial for admin accounts because it adds an extra layer of security beyond just a password, making it significantly harder for unauthorised users to gain access even if they guess or steal your password. This helps protect your most powerful accounts from compromise.
- How often should I review admin account privileges?
- You should review admin account privileges regularly, at least every six months, or whenever there are changes in staff roles or responsibilities. This ensures that only current employees who genuinely need administrative access retain those powerful permissions, following the principle of least privilege.
- Can I use the same password for my regular and admin accounts?
- No, absolutely not. Using the same password for both your regular and admin accounts completely defeats the purpose of separating them and is a major security risk. Each account, especially privileged ones, should have a unique, strong password to prevent a single breach from compromising both.
Sources
Every reference below was link-checked when this article was published.
- 1.Best practices for Microsoft Entra rolesMicrosoft Learn
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
