Least Privilege Access Audit (QA)

Least Privilege Access Audit (QA)

1. 01

   Inventory every human and non-human identity with access to client systems

   Pull the full user list from your identity provider and directory, including service accounts, API keys, and AI agent credentials. Compare against the client's current employee roster and approved contractor list.

2. 02

   Map each identity to the specific resources it can reach

   Document which applications, data stores, and administrative consoles each identity can access. Note any standing privileges that bypass approval workflows.

3. 03

   Flag accounts with admin or elevated rights that lack a documented business need

   For every privileged account, require a written justification from the owning manager. Remove or downgrade any that cannot be justified within five business days.

4. 04

   Check for dormant or orphaned accounts that have not authenticated in 90 days

   Review last-login timestamps across your identity provider and target applications. Disable accounts with no activity in the past quarter, then confirm with the client before permanent deletion.

5. 05

   Verify MFA is enforced on all interactive logins and privileged actions

   Confirm that every human user has at least one enrolled second factor and that conditional access policies require it for admin consoles and sensitive data. Spot-check a sample of recent authentication logs.

6. 06

   Review shared credentials and secrets stored in plaintext or spreadsheets

   Search for hardcoded passwords, shared vaults with overly broad access, or credentials pasted into chat tools. Move any findings into a managed vault with per-user access controls.

7. 07

   Document the audit results and deliver a remediation plan to the client

   Summarize the number of identities reviewed, risks found, and actions taken or pending. Include a timeline for closing any gaps and assign an owner for each remediation item.