Topic starter
06/11/2026 6:37 pm
TL;DR: Least privilege becomes materially harder for MSPs because technicians need privileged access across many client environments, which drives shared credentials, delayed rotation and wider blast radius when an account is compromised, according to Admin By Request. The governance problem is not policy intent but cross-client privilege containment under operational pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “Why Least Privilege Is Harder (And More Important) for MSPs”.
Key questions
Q: Why do shared credentials create so much risk in MCP deployments?
A: Shared credentials erase accountability and make containment harder because every tool call appears to come from the same identity.
Q: Why does just-in-time privileged access reduce risk for remote workers and administrators?
A: Just-in-time privileged access reduces risk because it replaces persistent credentials with temporary authorization that exists only for the task at hand.
Practitioner guidance
- Enforce per-technician identity Stop using shared administrative credentials for client access and require each technician to authenticate as an individual before privilege is granted.
- Move to task-scoped elevation Grant administrative rights only for a named task, then remove them automatically when the task ends or the approval window closes.
- Remove standing client access Audit technician accounts for persistent rights across client environments and eliminate any access that remains active without a current business reason.
Bottom line: MSP least privilege fails when technician access is reusable across many clients, because one compromised secret can cross organisational boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
MSP privilege management is a cross-client containment problem, not a single-environment policy problem. The same control that is manageable inside one enterprise becomes fragile when one technician can touch dozens of estates. That changes least privilege from a static entitlement question into a tenancy and delegation problem, because the blast radius of failure is inherently larger.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why does just-in-time privileged access reduce risk for remote workers and administrators?
A: Just-in-time privileged access reduces risk because it replaces persistent credentials with temporary authorization that exists only for the task at hand. That means there are fewer leave-behind secrets to steal or share, less chance of misuse after access is no longer needed, and stronger control over who can reach sensitive systems. It also improves accountability through individual audit trails.
👉 Read our full editorial: Least privilege is harder for MSPs because access scales