Practical admin access controls for companies with 15-80 employees. How to enforce least-privilege without creating bottlenecks that frustrate your team.
Executive summary: Administrative accounts are the highest-value targets in your environment because they have unrestricted access to systems, data, and configurations. At companies with 15-80 employees, admin access is commonly over-distributed — too many people have too much access because it is easier than managing permissions carefully. This creates a blast radius problem: if any admin account is compromised, the attacker inherits access to everything. Securing admin access without creating bottlenecks requires separating daily-use accounts from administrative accounts, implementing just-in-time access for elevated tasks, and establishing a review cadence that keeps permissions aligned with actual roles.
In most companies your size, at least five people have admin access to systems they do not administer. The access was granted during a project, an emergency, or a setup phase and was never revoked. Each unnecessary admin account is an unlocked door that attackers can use to access everything if they compromise any one of them.
Over-provisioned admin access exists because saying yes to an access request takes ten seconds while managing the request properly takes ten minutes. Over time, that convenience creates an environment where the compromise of any single account can cascade to every system the account can reach. Securing admin access is not about restricting your team — it is about ensuring that a single compromised credential cannot take down your entire operation.
Each person has a standard account for daily work — email, documents, applications — and a separate administrative account that is only used when performing administrative tasks. Administrative sessions require explicit elevation and are logged. Access reviews happen quarterly, and any administrative access that is no longer justified by the person's role is revoked. The result is that compromising a standard account gives an attacker access to nothing beyond what that role requires.
The path of least resistance is to make everyone an administrator so nobody has to request access. This eliminates friction and maximizes blast radius. When any account is compromised, the attacker has administrative access to everything.
When the same account is used for email browsing and system administration, a phishing email that compromises that account immediately gives the attacker admin-level access. Separating daily-use and admin accounts limits what a phished credential can reach.
Access granted for a project, an emergency, or a migration that is never revoked accumulates over time. After two years, an account may have access to systems the person has not touched in 18 months but could be exploited if compromised.
Digital agency (Marketing Services): 73% reduction in admin-level accounts. An access audit revealed 22 admin-level accounts in a 35-person company. After implementing role-based access with separate admin accounts and just-in-time elevation, admin-level accounts were reduced to 6, each with specific documented justification.
Financial planning firm (Financial Services): Zero scope creep in 12 months with quarterly access reviews. Implemented quarterly access reviews where every administrative account must be re-justified by the account holder's manager. In 12 months, six previously unnecessary admin privileges were identified and revoked before they could become attack vectors.
| Metric | Before | After |
|---|---|---|
| Admin-Level Accounts | 22 (in 35-person company) | 6 (with justification) |
| Admin Access for Daily Work | Standard practice | Separated accounts |
| Access Review Cadence | Never | Quarterly |
| Unnecessary Permissions | Unknown (unaudited) | 0 (quarterly verified) |
Administrative access is the keys to the kingdom. In your environment, admin accounts can install software, modify configurations, access all data, change security settings, and manage other user accounts. They are the highest-value targets for any attacker.
At companies with 15 to 80 employees, admin access distribution typically follows the path of least resistance: someone needed access to fix something, so they got admin rights. That was three years ago. They still have admin rights. Multiply that by every access request over the company's lifetime and you have a significant number of accounts with unrestricted access.
Blast radius is the amount of damage an attacker can cause with a single compromised account. When every account is a standard user, the blast radius is limited to that user's data and applications. When an account has administrative access, the blast radius expands to every system that account can administer.
For most companies with 15-80 employees, an admin account can access financial systems, client databases, infrastructure management consoles, email administration, file server configurations, and backup management. Compromising one admin account is equivalent to compromising the entire company.
Separated accounts: Every person who needs administrative access receives two accounts — a standard account for daily work and an administrative account for administrative tasks. The standard account has the same access as any other employee in their role. The administrative account has elevated access but is used only when performing administrative work.
Just-in-time elevation: Administrative accounts are not permanently elevated. They request elevated access when needed, the access is granted for a defined time window, and it automatically revokes when the window expires. This means admin-level access exists in the environment only during active administrative work.
Quarterly access reviews: Every three months, each administrative account is reviewed against the account holder's current job responsibilities. Access that is not currently justified is revoked.
The result: your environment has administrative access only where it is needed, only when it is needed, and only for as long as it is needed. The blast radius of any single compromised account is minimized to the access appropriate for that person's daily work.
Part of the Security Hardening insights cluster at JubilantWeb. Reviewed by Nelson Penagos, Founder & Systems Architect. Contact: hello@jubilantweb.com | (407) 630-8771
You can, and many companies do. The cost is blast radius. When everyone is an admin, compromising any single account gives an attacker administrative access to every system. That one phishing click that captures credentials does not just expose one person's email — it exposes your financial systems, client data, infrastructure configuration, and backup management. With separated access, the same phishing click captures credentials for a standard account that can access email and documents but cannot install software, modify security settings, or access administrative consoles. The attacker gets in but cannot go anywhere dangerous. That containment is worth the minor inconvenience of managing permissions.
Two practices make least privilege practical without creating bottlenecks. First, separate standard and administrative accounts so daily work is unaffected — employees access email, files, and applications with their standard account exactly as they do now. Second, implement just-in-time elevation for administrative tasks — when someone needs admin access, they request it through a simple approval workflow that grants time-limited access. The approval can be automated for routine tasks and requires manager approval only for sensitive operations. Most companies find that after the initial adjustment period of two to three weeks, the separated account model adds less than five minutes per day in administrative overhead.
Just-in-time access means administrative permissions are granted only when needed and automatically expire after a defined period. Instead of having permanent admin access to a server, an IT administrator requests elevated access when they need to perform maintenance. The access is granted for two hours, logged, and automatically revoked when the window expires. This approach means that admin-level access exists only during active administrative work, not during the other 95% of the time when the account is being used for email and browsing. Azure AD Privileged Identity Management and similar tools support this model natively.
Quarterly reviews are the minimum effective cadence for companies with 15-80 employees. During each review, every administrative account should be verified by the account holder's manager against current job responsibilities. Access that is no longer justified by the person's role should be revoked. Additionally, access should be reviewed immediately when an employee changes roles, leaves the company, or completes a project that required temporary elevated access. The quarterly review catches the gradual accumulation of permissions over time, while event-triggered reviews catch immediate changes. Together, they prevent the permission creep that expands your attack surface over months and years.
Yes, and remote teams actually benefit more from separated access because remote work increases the attack surface. Remote employees use personal networks, personal devices, and personal email alongside business systems. When their daily-use account is separated from administrative access, a compromise of their home network or personal device does not automatically grant the attacker administrative access to business infrastructure. Cloud-based identity platforms like Azure AD and Google Workspace support separated accounts and just-in-time elevation natively, making implementation straightforward regardless of where employees are physically located.