Privileged access and emergency access review

How to use this resource

Review one environment at a time with identity, platform, security, and service owners.

• Name the environment, business owner, technical owner, reviewer, and review date.
• Define the platforms, tenants, directories, network devices, backup systems, and SaaS services in scope.
• Record exclusions, unavailable evidence, and the date after which the review becomes stale.
• Do not place passwords, recovery codes, private keys, or secret values in the worksheet.
• Classify the completed worksheet as sensitive security information and keep it in an approved, restricted location with access controls.
• Agree who may access the worksheet, how evidence is referenced, and the retention and secure disposal requirements before collection begins.
• Track every finding to an owner, decision, target date, and verification method.

1. Administrative identity inventory

• List named administrator accounts separately from everyday user accounts.
• List shared, service, automation, vendor, emergency, and platform-local accounts.
• Record the authoritative identity source and sign-in path for each account.
• Record assigned roles, group-derived privilege, eligible roles, and resource scope.
• Identify accounts exempt from normal conditional-access or network restrictions.
• Identify privileges inherited through nested groups, delegated administration, or partner relationships.
• Record account owner, approver, purpose, creation date, last review, and expected expiry.
• Flag accounts with no confirmed owner, no current purpose, or no recent evidence of use.

2. Authentication and workstation controls

• Record authentication methods permitted for each privileged path.
• Confirm phishing-resistant multifactor authentication where the platform supports it.
• Identify legacy protocols or recovery paths that bypass normal controls.
• Record whether administrators use dedicated accounts and hardened management devices.
• Separate privileged sessions from email, browsing, and ordinary productivity work.
• Record network, location, device-health, and session restrictions.
• Confirm enrollment and reset cannot be approved only by the same potentially compromised identity.
• Capture policy-assignment and test-sign-in evidence without storing secrets.

3. Emergency and break-glass access

• Define the failure scenarios emergency access must survive, including identity-provider, MFA, network, and device-management outages.
• Maintain at least two independently controlled emergency paths where platform design permits.
• Record custodians, storage method, access procedure, and an out-of-band contact route.
• Ensure emergency identities do not depend on the same federation, device, vault, or network path they recover.
• Alert on every emergency-account sign-in and configuration change.
• Test access through an approved procedure without exposing credentials.
• Record test date, tester, scenario, result, evidence reference, and corrective actions.
• Define rotation, incident review, and notification after any use.

4. Privilege lifecycle

• Document who may request, approve, provision, modify, and remove each privilege class.
• Require a business or operational reason and the narrowest practical scope.
• Prefer time-bound or just-in-time elevation where supported.
• Set expiry for temporary, project, vendor, and incident-response access.
• Connect joiner, mover, leaver, and extended-leave events to privilege review.
• Review dormant accounts, unused roles, duplicate paths, and conflicting duties.
• Verify removal through the target platform, not only the service ticket.
• Retain decision and verification evidence according to records requirements.

5. Logging, evidence, and closeout

• Log privileged sign-ins, failures, role changes, policy changes, token creation, and emergency use.
• Send material events to a destination administrators cannot silently rewrite.
• Define alert recipients, severity, after-hours routing, and response expectations.
• Test one representative alert from generation through investigation.
• Confirm logs identify the requester, privileged identity, automation, and target resource.
• Record each issue, consequence, compensating controls, owner, and due date.
• Prioritize exposed, shared, ownerless, dormant, and recovery-critical privilege first.
• Recheck the effective platform state after remediation and schedule the next review.

Important limitations

• This worksheet is general operational guidance, not a guarantee that all privileged access has been discovered.
• Platform capabilities and legal, labour, privacy, and records obligations must be confirmed for the organization.
• Account, role, authentication, and policy changes require system-owner authorization and approved change control, a preserved independent recovery path, documented rollback or re-enable steps, and post-change validation.
• Emergency-access testing must be authorized and designed to avoid lockout or weakened production controls.