Essentials for cloud
PRO-12 Least privilege access
Give every user, admin and non-person (software) account only the access it needs for its defined tasks. Keep the power to manage accounts and roles, or use privileged functions, to authorised admin roles. Review and update access periodically to match current roles and needs.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Periodically review and update access privileges in alignment with current roles, duties and business requirements.
In plain English: Review access rights from time to time. Update them to match current roles, duties and business needs.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Account Manipulation
- Valid Accounts
Action 2 of 3
Restrict permissions to create, modify, or delete accounts and roles, or to access privileged functions or applications, to authorised administrative roles.
In plain English: Allow only authorised admin roles to create, change or delete accounts and roles, or to access privileged functions or apps.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Create Account
- Account Manipulation
- Permission Groups Discovery
- Account Discovery
- Account Access Removal
Action 3 of 3
Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions.
In plain English: Give user, admin and non-person accounts only the minimum access and privileges they need to do their defined tasks.
- Domains
- Identity services
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- Who does it
- PaaSSupplied
- SaaSSupplied
- MITRE ATT&CK
- Create Account
- Account Manipulation
- Valid Accounts
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.