Glossary
Least privilege
Also called: Principle of least privilege, minimum necessary access
In one sentence
Least privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
In many small offices, everyone is an administrator on their own computer, everyone can open every shared folder, and the owner's everyday email account is also the global admin for Microsoft 365. It's convenient — until one of those accounts is compromised and the attacker inherits all of that access. Least privilege shrinks the damage any single account can do.
Common steps include: removing local admin rights from staff computers; using separate, MFA-protected admin accounts for IT tasks; limiting the number of global admins; setting folder and app permissions by role (front desk, clinical, billing, management); and removing access promptly when people change roles or leave.
Why it matters: for healthcare, least privilege lines up with HIPAA's “minimum necessary” standard and the Security Rule's access control requirements. For any business, it's one of the most effective ways to limit ransomware, because malware usually runs with the permissions of the user who triggered it. It's also a standard expectation in SOC 2 reviews and insurance questionnaires.
Least privilege doesn't have to slow people down. Done well, staff still have everything they use daily; what goes away is access nobody uses but an attacker would love.
Example: a receptionist at a dental office clicks a malicious link. Because her account isn't an administrator and can reach only scheduling and the front-desk shared folder, the malware can't install itself system-wide or reach the clinical imaging share or financial records. EDR catches it, and one PC gets cleaned instead of the whole office. See how this played out for a growing team in our software startup case study.
Related terms
- Zero trustZero trust is a security approach that never assumes a user or device is safe just because it's inside the office network — every access request is verified based on identity, device health and context.
- Microsoft Entra IDMicrosoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.
- RansomwareRansomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.