Privileged access management for small and mid-sized organisations

What privileged access management covers

A privileged account is any account that can change what other people cannot: a Microsoft 365 Global Administrator, a domain admin, the local administrator on a laptop, a service account that runs a backup job, or the account your IT provider uses to support you. Attackers go after these accounts first, because one of them can switch off security tools, create new accounts, read every mailbox or push ransomware to every device.

Privileged access management (PAM) answers four questions about those accounts:

• Who holds admin rights, and whether they still need them
• When the rights are active: permanently (standing access) or only for the task in hand (just-in-time access)
• How admin credentials are protected: stored in a vault, rotated and used without being revealed, rather than written down or shared
• What was done with them: approvals, sessions and changes recorded for audit

Enterprise PAM platforms can be big projects. For a small or mid-sized organisation the principles are the same, but the practical route is to tackle the places admin rights actually live, one layer at a time. PAM sits within the wider set of identity security controls, alongside MFA, conditional access and identity threat detection and response.

Three layers of PAM, mapped to the tools we supply

Most organisations want all three in the end, but they rarely start in the same place.

Layer 1: cloud admin roles with Privileged Identity Management Microsoft Entra Privileged Identity Management (PIM) replaces permanent admin roles with eligible ones that are activated only when needed. Microsoft lists its key features as just-in-time privileged access to Entra ID and Azure resources, time-bound assignments with start and end dates, approval to activate privileged roles, MFA enforced on activation, a justification for each activation, notifications when privileged roles are activated, access reviews and downloadable audit history. PIM for Groups extends the same model to group membership.

PIM needs Microsoft Entra ID P2 or Entra ID Governance. P2 is included in Microsoft 365 E5 and the Microsoft Defender Suite, and Business Premium customers can add it on its own or through the Defender Suite for Business Premium add-on. See Microsoft Entra ID P1 vs P2 for the full comparison.

Layer 2: admin credentials and sessions with KeeperPAM KeeperPAM is Keeper's privileged access management platform, built on the same zero-knowledge model as its password manager. It vaults and rotates privileged and service account passwords, launches RDP, SSH, VNC and database sessions from the vault through Keeper Gateway so admins reach servers without seeing the credentials or opening inbound ports, records those sessions, and adds discovery of privileged accounts and just-in-time access without standing privileges. If your staff already use Keeper for passwords, it extends from the same admin console. Our Keeper Security guide covers it in detail.

Layer 3: endpoints with CyberFOX AutoElevate Local admin rights on everyday computers are the layer many smaller organisations leave open, usually because taking them away creates a stream of requests for IT. CyberFOX built AutoElevate for that gap and describes it as privileged access management for lean IT teams. On staff computers it answers the same four PAM questions:

• Who holds admin rights: staff work as standard users. AutoElevate can take accounts listed directly in a computer's local Administrators group out of it, a company, location or computer at a time (domain group membership is managed separately)
• When rights are active: only for the approved task. Software IT already trusts elevates by rule; anything new goes to a technician, who can approve it once or turn the decision into a rule for that computer, site, company or every device
• How admin credentials are protected: by default an approved task runs under a separate built-in account that is made a local administrator for milliseconds, with its random password changed before and after, so in most cases the user's own account stays a standard user. For hands-on work, IT staff get just-in-time admin access to a Windows workstation by scanning a QR code on their phone, with no password to hand over
• What was done with them: requests and decisions are logged in the AutoElevate admin portal and, with a PSA or ticketing integration (ConnectWise Manage, Datto Autotask PSA, Halo PSA, ServiceNow, Freshservice and others), each request opens a ticket recording the requester, machine, decision and outcome

Approvers decide from the AutoElevate Notify app on Android or iOS, helped by a VirusTotal reputation check. AutoElevate's Blocker can also stop more than 200 built-in Windows programs, binaries and DLLs that attackers misuse in living-off-the-land attacks: after an audit period it recommends what to block for your environment, from a list CyberFOX maintains using Microsoft guidance, the LOLBAS project and its own research. For day-to-day detail and a comparison with Keeper's equivalent, see endpoint privilege management.

Why PAM matters for insurance and compliance

Three pressures are moving privileged access up the list for UK organisations:

• Cyber insurance: insurers' questionnaires can ask how you control admin accounts and local admin rights. CyberFOX notes that taking admin rights away helps organisations meet compliance goals and the PAM requirement in most cyber insurance cover
• Cyber Essentials: user access control requires separate admin accounts used only for admin tasks, and removal of special privileges when they are no longer needed. At Cyber Essentials Plus, the assessor checks that a standard user trying to run an administrative process is asked for a separate login. See Cyber Essentials user access control
• NCSC guidance: the NCSC's 10 Steps to Cyber Security advises a tiered model for administrative accounts, using fully privileged accounts such as domain, global or cloud admins only when absolutely necessary, MFA on admin accounts, separate accounts for everyday email and browsing, and regular reviews that revoke privileges no longer required

Least privilege is also a recommendation of the CIS Critical Controls and NIST, as CyberFOX points out. PAM turns that principle into something you can show an insurer or assessor: who holds admin rights, who approved each elevation and when it ended.

Where to start: a PAM plan for lean IT teams

You do not need every layer on day one. This is the order we usually suggest:

1. List every privileged account: tenant admin roles, domain admins, service accounts, shared admin logins and the accounts your IT provider uses. Remove the ones nobody needs.
2. Separate admin from everyday work: give each administrator a named admin account, protected by phishing-resistant MFA and used only for admin tasks.
3. Take local admin rights off staff computers: start AutoElevate on a pilot group, build rules from the requests that come in, then widen it a group at a time.
4. Move cloud roles to just-in-time: on Entra ID P2, make admin roles eligible in PIM rather than permanent, with approval for Global Administrator.
5. Vault and rotate admin credentials: put server, network and service account passwords in KeeperPAM, rotate them and launch sessions from the vault.
6. Keep a break-glass route: a restricted emergency admin account with a unique, managed password, documented and monitored.
7. Review on a schedule: run access reviews of admin roles and check elevation and session records.

Steps 1 and 2 need no new licences, and many Microsoft 365 tenants already hold what step 4 needs. Our Microsoft 365 security assessment shows what you own.

We use AutoElevate ourselves

We use CyberFOX AutoElevate in our own business. Forever Systems can supply AutoElevate licences for your organisation, deploy the agent through the tools you already use, such as Microsoft Intune, Group Policy or an RMM, and connect it to your ticketing system.

Points that suit a lean IT team:

• Licensed per active agent: CyberFOX licenses AutoElevate on the agents installed and registered on your computers rather than per technician, so your IT lead can approve requests and, if you want, our team can too, with the scope agreed at quote
• Co-management: your own administrators can have AutoElevate accounts with Technician Level 1 or Level 2 or Downstream Admin roles, approving requests without access to global settings
• Users are kept informed: while a request waits for a technician, AutoElevate tells the user it is being reviewed and a ticket has been opened, then lets them know when it is approved or denied

Which edition you need depends on the controls you want (QR code admin access and Blocker, for example), and we confirm that at quote. AutoElevate can be billed monthly, terms confirmed at quote; see CyberFOX AutoElevate licensing on our licensing site.

How we help

We review where admin rights live across your Microsoft tenant, servers and staff computers, explain the risk of each gap in plain English and give you a prioritised plan. We then put the right layer in place first, whether that is Privileged Identity Management on Entra ID P2, KeeperPAM for admin credentials and sessions or AutoElevate for local admin rights, and support you afterwards. For licensing, see KeeperPAM licensing and our wider guide to privileged access management software. Pricing depends on users, endpoints and products: ask us for a quote.

Contact us to plan privileged access management for your organisation.