Key takeaway
Bring identity stores, privileges, authentication and monitoring into one control model; do not grant implicit trust based on network location or device ownership.
Inventory every identity type
Discover human and admin accounts, service and application identities, API keys, devices and emergency access. Assign each an owner, business purpose, resources and expiry. An account left behind after a departure, or an abandoned service identity or token, can become a persistent access path. Discovery tools can enrich the inventory, but the organization remains responsible for ownership and reliable revocation.
Apply risk-appropriate authentication and authorization
For each access request, verify the subject, target resource and permissions required for the action. Use strong, preferably phishing-resistant MFA for human sign-ins to sensitive and administrative resources; configure workload authentication for its technical flow. Grant only necessary permissions; put approval and an expiry on temporary elevation. Device health and context can provide extra signals, but location or network address alone does not prove identity.
Investigate identity events
Log sign-ins, privilege changes, token and secret use, new trust relationships and account disablement. Correlate these events with endpoint and cloud telemetry to investigate unexpected behavior. Maintain log coverage and integrity, assign alert owners and document approved response steps. A deviation from normal activity alone does not prove an attack; decisions should follow investigation and context.
Distinguish human and non-human identities
Human and workload identities authenticate differently. Separate privileged identities and reduce standing admin rights. Define an owner, authentication path, resource scope and revocation method for each identity type.
| Identity | Authentication and access | Lifecycle check |
|---|---|---|
| Human employee | MFA and approved role access | Manager approval, protected self-service recovery and departure revocation |
| Privileged administrator | Separate account, supported strong MFA and time-limited elevation | Approval, expiry and actual privilege removal |
| Workload/service | Scoped short-lived credentials and federation where supported; no human MFA prompts | Owner, service role, secret store, key review and revocation |
| Emergency identity | Monitored and tested access | Recovery path independent of the affected sign-in service; access tests and post-use review |
Respond to account takeover and privilege misuse
Stolen credentials, an unapproved MFA reset, a stolen session token and excessive permissions can be different signs of one incident. Correlate sign-in logs, token and session details, device telemetry and group changes on one timeline. Once suspicion is confirmed, restrict the account, revoke sessions and refresh tokens, rotate secrets, review connected applications and workload identities, then reconfirm permissions with the owner. Verify session and token revocation support and effective loss of access in each application; some sessions and existing access tokens may remain valid until their own expiry.