What should MSPs prioritise first in an identity-first security shift?

Why This Matters for Security Teams

An identity-first shift is not a generic tooling refresh. For MSPs, it is a change in where trust is decided: at login, at entitlement grant, and at task execution. That matters because attackers rarely need to break encryption if they can abuse remote access paths, overbroad permissions, or stale secrets. NHIs are already central to that risk, and Ultimate Guide to NHIs shows that 97% of NHIs carry excessive privileges, which makes entitlement scope a first-order control problem rather than a back-office hygiene issue.

The practical priority is to reduce exposure where identity decisions have the biggest blast radius: remote access, application onboarding, privileged sessions, and secret handling. The NIST Cybersecurity Framework 2.0 frames this well by pushing organisations to formalise access governance instead of relying on network perimeter assumptions. For MSPs, that also aligns with client trust, because the provider is often operating across multiple tenants, tools, and delegated admin paths at once. In practice, many security teams discover their biggest identity gaps only after a technician account, API key, or remote admin path has already been abused.

How It Works in Practice

MSPs should start by mapping the access paths that combine high privilege with high repetition. Remote support tools, admin portals, RMM platforms, cloud consoles, PSA integrations, and onboarding workflows usually sit at the center. Once those paths are known, the first control move is to shift from static trust to identity-aware decision points: who is accessing what, from where, for how long, and under which approval state.

For human operators, that means tightening privileged access management, using strong authentication, and reducing standing access. For machine and service access, it means inventorying The State of Non-Human Identity Security risk signals such as over-privileged accounts and weak visibility into third-party OAuth connections. That research also highlights that only 1.5 out of 10 organisations are highly confident in securing NHIs, which is a useful reminder that maturity is usually lower than assumed.

• Prioritise remote access first, because it is both externally exposed and highly reusable across clients.
• Replace shared or long-lived admin credentials with named identities, strong MFA, and just-in-time elevation.
• Review tenant onboarding so each new client gets scoped access by default, not inherited access by convenience.
• Classify secrets by blast radius and move the most exposed keys into managed rotation and revocation workflows.
• Log delegated actions at the identity layer so cross-tenant activity can be traced without ambiguity.

Current guidance suggests that MSPs should not try to rip out every network control at once. Instead, they should move the highest-risk decisions into identity-aware workflows first, then expand coverage into lower-friction systems. These controls tend to break down when legacy remote tools require shared credentials or when client-specific exceptions are hard-coded into brittle onboarding scripts.

Common Variations and Edge Cases

Tighter identity controls often increase operational overhead, so MSPs have to balance access reduction against technician speed and client uptime. That tradeoff is real, especially when small service desks support many tenants and rely on automation to stay efficient.

The main edge case is legacy infrastructure. Some environments still depend on shared local admin accounts, static VPN profiles, or application credentials that cannot be segmented cleanly. In those cases, best practice is evolving, but the direction is consistent: isolate the legacy path, shorten credential lifetime, and wrap compensating controls around it until it can be retired. Another edge case is client-dictated control ownership, where the MSP can manage workflows but not the underlying tenant policies. Then the first priority is to standardise what the MSP can control, especially privileged access, secret rotation, and onboarding approvals.

For teams comparing frameworks, identity-first sequencing is also consistent with emerging NHI guidance from Top 10 NHI Issues and with the access governance emphasis in NIST CSF 2.0. There is no universal standard for exactly how fast an MSP should replace every perimeter dependency, but the practical rule is simple: secure the access paths that can reach the most clients, the most systems, and the most secrets first.

Related resources from NHI Mgmt Group

• Should organisations prioritise IGA or identity security first?
• How should security teams use digital identity wallets without weakening access control?
• How should security teams evaluate versionless identity security in practice?
• How can organisations tell whether they need orchestration controls or identity controls first?