Discover existing privileged roles
Implementation Effort: Medium – IT and security teams must identify privileged role holders, analyze their access, and determine if lower-privilege alternatives are appropriate.
User Impact: Low – Most users will not notice a change unless their access level is reduced after review; communication and support will be needed for any changes.
Overview
Discovering who holds privileged roles in the organization is a foundational step toward enforcing least privilege and Zero Trust principles. This process begins by creating an inventory of all users with elevated roles, using tools like Microsoft Entra ID or Microsoft Graph. Once that list is complete, each assignment should be reviewed to understand what permissions are actually used and whether they match the user’s job responsibilities. If users have broader access than needed, the role should be adjusted to a more appropriate one. This work supports "Use least privilege access" by actively reducing unnecessary permissions, "Verify explicitly" by basing role assignment decisions on job evidence and documented usage patterns, and "Assume breach" by shrinking the blast radius of a compromised privileged account. Without a full inventory and regular review of privileged access, organizations leave themselves open to over-provisioning, insider threats, and blind spots in identity governance.