Restrict administrative privileges

This strategy limits what privileged accounts can reach and how administrators perform sensitive work. Its controls cover approval, separation, expiry, credentials, logging and administrative workstations.

What is required, and where

Maturity Level One requires:

• privileged access requests validated when first requested
• dedicated privileged accounts used solely for privileged duties
• privileged accounts prevented from accessing the internet, email and web services, with the online-services exception below
• separate privileged and unprivileged operating environments
• unprivileged accounts prevented from logging on to privileged environments
• privileged accounts prevented from logging on to unprivileged environments, except for local administrator accounts

Maturity Level Two adds:

• privileged access to systems, applications and data repositories disabled after 12 months unless revalidated
• privileged access to systems and applications disabled after 45 days of inactivity
• administrative activities conducted through jump servers
• privileged environments not virtualised within unprivileged environments
• break glass, local administrator and service account credentials that are long (at least 30 characters), unique, unpredictable and managed
• privileged access, account-management and security-group-management events centrally logged

Level Two also requires logs to be protected and internet-facing server logs to be analysed. Incidents must be reported to the chief information security officer (CISO) and ASD, and the incident response plan must be enacted.

Maturity Level Three adds:

• Secure Admin Workstations
• just-in-time administration
• privileged access limited to only what is required
• Credential Guard, Remote Credential Guard, Local Security Authority (LSA) protection and memory integrity
• log analysis expanded to non-internet-facing servers and workstations

See the requirements matrix for every control at each maturity level.

When privileged accounts may access online services

The internet restriction in the Essential Eight Maturity Model reads, in full:

Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.

The exception allows explicitly authorised accounts to administer online services. ASD's Essential Eight assessment process guide gives accounts used to manage cloud services as an example.

A second control limits authorised privileged accounts to what users and services require for their duties. The exception is therefore scoped, not a blanket exemption.

This permits administration of services such as AWS or Azure. It does not permit unrestricted browsing or email from a privileged account.

What counts as a privileged account

The Information Security Manual defines a privileged account by what it can do, not by its title:

User accounts that have the capability to modify system configurations, account privileges, event logs or security configurations. This also applies to user accounts that may only have limited privileges but still have the ability to bypass some system controls. A privileged user account may belong to a person or a service.

The definition includes service accounts and accounts with narrow permissions that can bypass a control. An inventory limited to domain administrators is therefore incomplete.

Commonwealth implementation

ASD's Commonwealth Cyber Security Posture in 2025 puts restrict administrative privileges at 46% of Commonwealth entities at Maturity Level Two or above in 2024–25. MFA was the only strategy with a lower result. Administrative privileges had fallen to 31% in 2023–24.

These controls change day-to-day administrative workflows: separate accounts and environments, time-limited access, jump servers and managed credentials. The Commonwealth figures show the implementation result, but do not identify which of those requirements caused it.

How this strategy supports backup protection

Administrative privileges are what an attacker escalates to. The adversary descriptions in the Essential Eight Maturity Model set out the progression. At Level Two, if compromised accounts have special privileges "they will exploit it, otherwise they will seek user accounts with special privileges". Such an adversary "may also destroy all data (including backups) accessible to a user account with special privileges."

That is why this strategy and regular backups tighten in parallel. The backup requirements at Levels Two and Three are written specifically to survive a compromised privileged account.