The privileged access review
Ask who holds the domain admin credentials for a mid-sized client and you will get a confident answer. Then open the vault access log. Two former engineers, last spring's contractor, and a client staff member who needed it once during an outage and never handed it back.
Every grant made sense on the day. The contractor needed it for a migration. The client needed it on a Saturday when nobody else picked up. Together they are a list of ways in, any one of which hands over everything, and the client assumes you checked long ago.
Gather first: the directory's admin group membership and the vault access log.
The prompt:
Find out who holds the most powerful credentials at one of our clients, then help me cut that list to the people who need them today.
What experienced engineers know about privileged access drift:
Access builds up one urgent favor at a time: a contractor for a migration, a client staff member during a weekend outage, an engineer who moved teams. Nobody decides to grant permanent access, and nobody removes it either.
The vault access log, the directory's admin group membership and the break-glass procedure often tell three different stories. The truth is the combination.
Any credential shared outside our team, even once, should be treated as known to an attacker until it is rotated.
Admin and service accounts for the client: [from the directory and the vault]
Vault access log for those credentials: [paste]
Our joiner and leaver process: [describe]
Do this:
Build a table of every privileged credential, who has access to it, when each person last used it and whether their current role still needs it. Flag anyone who has left, changed role or was given access for a single job.
List the credentials to rotate now, starting with domain or global admin, in an order that will not lock out live services.
Write a 10-minute monthly review routine and a rule that removes access within 24 hours of a leaver or a finished project.
If the log and the group membership disagree, show both and ask me which is authoritative instead of picking one.