Implement Least-Privilege Access

Info

ID: MS-M7017
MITRE mitigation: M1026

Grant users, service accounts, and applications only the minimum permissions necessary to perform their intended functions. This limits the potential impact of compromised accounts or applications by restricting what actions an attacker can take.

Techniques Addressed by Mitigation

ID	Name	Use
MS-TA7008	Valid cloud accounts	Grant users and service accounts only the minimum permissions required for their role.
MS-TA7020	Access to connected cloud storage	Grant applications and users only the minimum necessary permissions to storage resources.
MS-TA7006	Serverless trigger injection	Grant serverless functions only the permissions necessary to complete their tasks.
MS-TA7010	Cloud native terminal	Restrict permissions to access cloud-native terminals (Kudu, Systems Manager, Cloud Shell) to only authorized administrators.
MS-TA7013	Cron jobs	Restrict who can create or modify scheduled jobs.
MS-TA7023	Connector reuse	Restrict who can view or modify connector configurations containing third-party credentials.
MS-TA7026	Event data capture	Restrict permissions to read logs and diagnostic data to only authorized users and roles.
MS-TA7025	Access application database	Grant applications and identities only the database permissions required for their function.
MS-TA7028	Data theft	Limit access to sensitive data based on need-to-know principles and role-based permissions.
MS-TA7016	Access workload identity credentials	Grant workload identities (managed identities, IAM roles, or service accounts) only the minimum permissions needed for their function.
MS-TA7015	Access cloud resources	Scope identity permissions tightly to specific resources and actions using resource-level policies and deny-by-default strategies.