Organize Identity, Permissions and Access Reviews
Distinguish authentication from authorization, assign permissions to real responsibilities, and manage joiners, role changes, departures and recovery access.
Is this the right guide for you?
- What is the difference between authentication and authorization?
- How do I assign permissions without making everyone an administrator?
- Which accounts should receive stronger authentication first?
- How should access change when an employee changes role or leaves?
- What should a periodic access review verify?
- How do I plan emergency access without leaving an unprotected shared account?
On this page
Authentication establishes control of an identity; authorization determines which actions that identity may perform. A person can sign in successfully and still lack permission to approve a payment or view another team’s records. Treat these as separate controls. NIST’s zero-trust guidance also rejects implicit trust based only on network location, so being inside an office network is not a substitute for an access decision.
Build roles around business responsibilities
List important actions and the information each role needs. Separate routine work from administration, approval and publication where the business requires it. Grant the smallest useful scope and identify who approves exceptions. Avoid using job title alone when two people with the same title handle different records. Test permissions on the server or service that performs the action, not merely by hiding a button. Keep service accounts distinct from personal accounts and assign an owner to each.
Strengthen authentication and recovery
Prioritize administrators, remote access and accounts handling sensitive business information. Different authentication methods offer different properties; use the strongest appropriate supported method and plan the transition. NIST’s authentication guidance addresses authenticators and their lifecycle, including recovery concerns. Make enrollment, lost-device handling and recovery verification part of the plan. A strong sign-in method can be undermined by a weak helpdesk recovery process. Store recovery material under controlled access and avoid distributing codes in ordinary shared documents.
Manage joining, moving and leaving
Create a request and approval path for new access. When a person changes role, remove permissions no longer required rather than simply adding new ones. On departure, address sessions, group membership, delegated access, shared secrets and third-party systems as well as the main account. Agree timing according to risk and business continuity. Keep a record showing what was requested, approved and completed so the organization can distinguish an intended change from an incomplete task.
Review access and rehearse emergency operation
At an appropriate interval, ask owners to confirm active users, privileged roles, unused accounts and external access. Investigate exceptions instead of approving a whole list without review. Emergency access should have an accountable owner, strong protection, restricted use and post-use review. Test that authorized recovery is possible without exposing a standing shared administrator password. Continue to secure remote work, security foundations and incident readiness. Discuss the defensive scope and existing identity environment through IT Services.
Primary references and further reading
Connect the idea to your business.
Start with your goals, existing systems and constraints before choosing a solution.
IT Services