Essential Eight RA-ML1.4 Limit privileged user accounts to essential online service access
What it says
Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users and services to undertake their duties.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly allow privileged accounts the minimum access needed for online duties.
This control is about making sure that people with special access to your systems can only use those privileges for their job-related activities online. It's important because it stops unauthorised persons from taking advantage of these accounts to cause harm or steal information.
Free. Save your status, tasks and notes.
Why it matters
If privileged accounts have unnecessary online service access, attackers can abuse stolen credentials or tokens to access cloud/SaaS admin portals and sensitive data.
How to implement
The IT manager should review which employees need privileged accounts to do their job online and limit these accounts to essential services only.
System administrators should create a list of online services that require privileged access and ensure accounts are only set up for these specified services.
The security officer should implement a system where any changes to privileged accounts require approval from a supervisor and are documented.
IT staff should use tools to regularly check and confirm that privileged accounts do not have unnecessary internet access, thereby reducing exposure to potential security threats.
Keep it running
Maintain an approved list of online services each privileged account may use, review it routinely, and remove any SaaS, email, or cloud console access not required for duties.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show me the process used to review and limit privileged account access?
Look at
Examine the documentation detailing the list of services needing privileged access and approval workflows.
Good evidence
A comprehensive list of online services requiring privileged access with supporting approval documentation should be available.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure privileged accounts don't have unnecessary internet access?
Look at
Check network settings and logs to confirm privileged accounts' internet access is restricted or monitored.
Good evidence
Settings and logs should clearly show restricted internet access for privileged accounts, except those explicitly approved.
Mappings
Closest match in ASD Information Security Manual: ISM-1175, Restrict privileged users from internet access, which asks for the same thing.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
E8-RA-ML1.4 requires enforcing least privilege for privileged accounts that are authorised to access online services. ISO/IEC 27001:2022 Annex A 5.15 is broader, requiring the organisation to establish and implement access control policies and procedures based on business and security requirements, within which least privilege for privileged online access would be defined. The primary is an operational requirement that would typically be implemented under the policy framework described by Annex A 5.15.
This control partially meets A.5.18.
E8-RA-ML1.4 requires limiting authorised privileged account access to online services to what is necessary for duties. ISO/IEC 27001:2022 Annex A 5.18 addresses the broader lifecycle management of access rights (provision, review, modification, removal) for information assets, which would include managing privileged access to online services.
This control partially meets A.8.2.
E8-RA-ML1.4 requires that privileged accounts authorised to access online services are restricted to the minimum necessary access for duties. ISO/IEC 27001:2022 Annex A 8.2 broadly requires that privileged access rights are allocated and used in a restricted and managed manner, which encompasses limiting privileged accounts' online service access.
This control partially meets A.8.3.
Annex A 8.3 requires access to information and associated assets to be restricted in accordance with an access control policy. E8-RA-ML1.4 relates by constraining privileged accounts that are authorised for online services to only the minimum access required, applying least privilege to a high-risk access class. Annex A 8.3 is broader because it applies to all access to information/assets and is not limited to privileged accounts or online services.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1175.
E8-RA-ML1.4 requires privileged accounts authorised for online services to be tightly limited to only what is needed to perform online duties. ISM-1175 implements the same policy intent by preventing privileged accounts from accessing internet/email/web services unless explicitly authorised, thereby constraining privileged online service access to authorised need.
This control is equivalent to ISM-1883.
ISM-1883 requires that privileged user accounts authorised to access online services are limited to only what is necessary to perform duties. E8-RA-ML1.4 states the same requirement for privileged accounts explicitly authorised to access online services, with essentially identical scope and intent. Implementing E8-RA-ML1.4 would largely satisfy ISM-1883 for this online-services privilege-limitation requirement.
This control partially meets ISM-1508.
E8-RA-ML1.4 requires privileged accounts to be limited to essential access specifically for online services. ISM-1508 applies the same least-privilege principle to privileged access across systems and resources generally, regardless of whether access is to online services. The primary is a specific subset of ISM-1508 focused on online service access by privileged accounts.
This control partially meets ISM-1833.
E8-RA-ML1.4 requires that privileged accounts authorised for online services have only the access required to perform their duties. ISM-1833 supports this outcome by requiring user accounts (in AD provisioning) to be given minimum privileges, which is a practical mechanism used to enforce least privilege for privileged identities. ISM-1833 is broader in covering account provisioning generally, while the primary is specifically about privileged accounts and online service access.
This control partially overlaps ISM-0441.
ISM-0441 requires limiting what temporarily authorised personnel can access to only the data required for their duties. E8-RA-ML1.4 applies the same least-privilege principle but narrows it to privileged accounts for online services. The shared intent is restricting access to what is necessary, but ISM-0441 is broader and more specific about temporary conditions.
This control partially overlaps ISM-1852.
ISM-1852 requires organisations to restrict unprivileged access to only what is required for users and services to do their jobs. E8-RA-ML1.4 restricts privileged accounts authorised to access online services to only what is required for duties, applying least privilege in a specific channel (online services). The controls intersect on limiting access to need-to-know/need-to-do, but ISM-1852 is unprivileged and broad, while E8-RA-ML1.4 is privileged and narrower to online service access.
This control partially overlaps ISM-1927.
ISM-1927 requires that only privileged users with a genuine need can access key identity servers (AD DS/AD CS/AD FS/Entra Connect). E8-RA-ML1.4 focuses on limiting what privileged accounts are explicitly authorised to access in online services to only what is required. They overlap on least-privilege restrictions for privileged accounts, but E8-RA-ML1.4 is oriented to online service access entitlements while ISM-1927 is specifically about restricting interactive/administrative access to on-prem/hybrid identity infrastructure servers.
This control partially overlaps ISM-2068.
E8-RA-ML1.4 requires that privileged accounts authorised to use online services are limited to only the access required for their duties. ISM-2068 overlaps by limiting which networked devices are allowed internet connectivity, which can indirectly constrain where privileged accounts can access online services from and reduce unnecessary pathways. The primary is identity/authorisation focused for privileged accounts, while ISM-2068 is device/network connectivity scoping irrespective of account privilege.
- ISM-2156Restrict agentic AI applications to minimum tools, functions and permissionsPartially overlaps
This control partially overlaps ISM-2156.
ISM-2156 requires agentic AI applications to be restricted to the minimum tools, functions and permissions for their intended purpose. E8-RA-ML1.4 requires privileged accounts' access to online services to be explicitly authorised and limited to necessary duties. This aligns with least-privilege constraints applied to AI agent service accounts or operator privileged accounts.
This control supports ISM-0445.
E8-RA-ML1.4 requires privileged accounts authorised for online services to have only the minimum access needed to perform online duties. ISM-0445 supports this by mandating dedicated privileged accounts used solely for privileged activities, making it easier to apply and evidence strict limitations for any privileged account that must access online services.
This control depends on ISM-1507.
E8-RA-ML1.4 requires that privileged accounts authorised for online service access are strictly limited to what is necessary. ISM-1507 supports this by requiring validation of requests for privileged access at the time of request, helping ensure online service authorisations and associated privileges are justified and duty-aligned. ISM-1507 addresses request validation, whereas the primary addresses the actual restriction of granted online service access.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-12.3Provision user, administrative and non-person accounts with minimum required privilegesPartially overlaps
This control partially overlaps IT.PRO-12.3.
IT.PRO-12.3 requires user, administrative and non-person accounts to be provisioned with only the minimum access and privileges they need; E8-RA-ML1.4 strictly limits privileged accounts authorised to access online services to what their duties require, a narrower case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.