Privileged access management (PAM) is how a business controls the accounts that can change its systems: admin logins for Microsoft 365, servers, firewalls and backups. The Essential Eight requires it under restricting administrative privileges, because one stolen admin login can hand an attacker your whole network.
Key Takeaways
- PAM controls who holds admin rights and when they lose them.
- Restricting administrative privileges is one of the eight strategies.
- 42% of serious (C3) incidents in ASD’s 2024-25 threat report involved compromised credentials.
- Level One needs no expensive software.
What is privileged access management?
A privileged account can install software, change security settings or delete backups. ASD’s guidance on restricting administrative privileges calls these accounts a valuable target. Attackers agree: ASD sent 9,587 credential exposure alerts to around 220 organisations between November 2024 and June 2025.
| Privileged account | What it controls |
|---|---|
| Microsoft 365 global admin | Every user and mailbox |
| Local administrator | Software and protection on one device |
| Service account | Backups or practice software, rarely watched |
| Break glass account | Everything, by design |
| Privileged access management keeps admin rights rare, separate and temporary. Staff work in a standard account and switch to a dedicated admin account only for admin tasks, so a phishing email opened on Tuesday morning can’t install ransomware across the network. |
Why does the Essential Eight require it?
Attackers usually get in as an ordinary user, often through social engineering, then hunt for admin credentials. ASD’s Annual Cyber Threat Report 2024-25 found 42% of C3 incidents involved compromised accounts or credentials. Requirements step up across ASD’s Essential Eight maturity model:
| Maturity level | Key requirements |
|---|---|
| One | Validated access requests; dedicated admin accounts with no email or web; separate admin environments |
| Two | Access disabled after 12 months unless revalidated, or 45 days unused; central logging |
| Three | Just-in-time administration; Credential Guard enabled |
| At Maturity Level One, the Essential Eight asks for four things: admin access requests are validated, admins use a dedicated account, those accounts can’t browse the web or read email, and admin work happens in a separate environment. |
Where should a small business start?
Human error caused 37% of the 532 data breaches notified between January and June 2025, according to the OAIC’s Notifiable Data Breach statistics. Fewer admin accounts limits the damage.
- List every admin account. Your IT asset register shows where to look.
- Remove local admin rights from everyday staff.
- Give IT admins separate accounts, blocked from email and browsing.
- Keep patch management current too.
- Review the list quarterly and whenever someone leaves.
Frequently Asked Questions
Identity and access management covers every user’s logins and passwords. PAM is the subset for accounts with admin rights, adding tighter approval, separate accounts and logging. It protects the accounts that cause the most damage when stolen.
Not for Maturity Level One. Separate admin accounts and removing local admin rights use settings already in Windows and Microsoft 365. Password vaults and just-in-time tools become worthwhile at Level Two and above.
ASD’s Level Two disables admin access after 12 months unless revalidated, or 45 days unused. We suggest a quarterly review plus same-day removal when staff leave. Our small business cybersecurity guide covers the wider basics.
Find out who holds the keys
Our Perth team can audit your admin accounts against Level One through our cyber security services or a managed IT plan. Or book a free consultation.
