Standing admin accounts became the thing everyone agreed to kill. The fix was just-in-time elevation: nobody holds Global Admin all day, they request it, use it, and it expires. On paper, least privilege. The dashboard shows zero permanent admins and everyone moves on.
The privilege didn't go away. It turned into eligibility.
Eligible Is Still a Standing Grant
An identity that can elevate to Global Admin whenever it wants is, to an attacker, a standing admin with an extra click. If that elevation carries no approval step, no time box, and no step-up MFA, just-in-time is a formality. Compromise the account and the path to full control is self-service.
Eligibility also hides better than a role assignment. Access reviews look at who holds admin today and see a clean list, while the accounts that can become admin on demand live in PIM's eligible assignments, a list nobody reviews with the same rigor. You dropped the standing count to zero and left the standing capability intact.
What Actually Gates Elevation
Least privilege lives in how hard it is to become an admin. A count of who holds the role today doesn't capture it. An eligibility grant is real least privilege when activation requires approval, expires on its own, and demands phishing-resistant MFA. Without those, it's a standing admin you've agreed not to count. Telling the two apart means looking past the role assignments to the elevation policy behind them, and asking what gates the moment a normal identity turns into a powerful one.
Zero standing admins is a good headline. The number that matters is how many identities can still become one at will.
See the latest from Abnormal's product and engineering teams.
