Security is hot on everyone’s mind these days.  As it should be with all the recent reports of hacking and data breaches. There isn't a day that goes by that you do not read a story of another data breach. With all this going on it brings up questions and concerns of how privileged access accounts are protected and secured.   “How are you securing those privileged accounts that have access to all your critical data?” Hmmm good question.... using a firewall is not a good enough answer. These privileged accounts are critical to your business and if they are compromised that can be devastating for some. It's critical to protect privileged access, regardless of whether the environment is on-premises, cloud, or hybrid on-premises and cloud hosted services. It's your data so you must protect it.   Privileged accounts can be in any of your systems and they almost always have elevated privileges. Some examples but not limited to :   Domain admin Server operators Global administrator Exchange/Teams/SharePoint administrator roles SQL and our database administrator Storage account Root access accounts Business applications specific accounts Any IT staff or user that has access to company systems that are elevated   Some tips , whether hybrid, cloud, or on-premises to limit the exposure to these accounts...   1. Use an Admin account separate from the normal user account. Separate accounts for technical staff or anyone that will be conducting administrative functions inside an application or system. For example: the domain admin should not be using their normal user account to perform domain/server admin functions. This should be a done by their admin account and not regular use account.   2. Privileged accounts should be limited to external services. What this means is the admin account your using should not be getting any personal emails and roaming the internet freely. Disable mail forwarding to external parties/domains from the privileged account. Restricting access to auto forwarding will prevent any accidental "leaks" of sensitive data. If the privileged account does need internet access ( in some cases this is needed) ensure that the account is being routed through proper web filtering. This also means account like these should not be browsing the web on a server. Yes, I know who you are and you should stop doing it!   3. Enable Multi factor authentication for all accounts but most importantly those privileged accounts. Yes it’s a pain to enter that pin received on your phone but ensuring that access was legit and authorized is far better than being hacked.    4. Use Role based access control (RBAC) for the privileged accounts. This sounds like a no brainer but it can easily be missed because it’s just easier to give and admin account access to everything and tell the user to use that account carefully... NOT. Even privileged access accounts need RBAC. Following the rule of least amount of privileges reduces the risk of exposure. Do not piggyback an account for access. I know it seems so much easier to just use 1 service account to perform all your duties and this service account also happens to run all the exchange services in your environment and then some. The exposure is too great by using 1 account and especially if you the admin are also using this account. Instead create separate service accounts limited to a specific service/application and the admin can have their own admin account.   5. Use Azure Active Directory Privileged Identity Management (PIM) to lower the exposure time of privileges. PIM does this by limiting users to only taking on their privileges "just in time" (JIT), or by assigning privileges for a shortened duration after which privileges are revoked automatically. PIM can also manage the Azure RBAC roles so It's like RBAC on steroids. Please note the use of Azure AD PIM does require an additional license.   6. Define at least two emergency access accounts also known as Break Glass Accounts. Emergency access accounts are highly privileged and are not assigned to specific individuals. Emergency access accounts are limited to emergency for 'break glass' scenarios where normal administrative accounts cannot be used.   These are just a few tips to get you started on making your privileged accounts more secure. For a detailed explainer and roadmap checkout this best practices article