# standing-privilege

Source: https://startwithidentity.com/glossary/standing-privilege/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not the person or workload is using it at the moment. It is the opposite of [just-in-time access](https://startwithidentity.com/glossary/jit-access/), and removing it is the goal of [zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/).

Microsoft's [Privileged Identity Management documentation](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure) makes the distinction precise. A "permanent active" assignment is one "where a user can always use the role without performing any actions": that is standing privilege. An "eligible" assignment requires the user to activate the role, with MFA, a justification or an approval, for a limited period. Microsoft also notes there is no difference in the access granted, only in when it exists. The control does not reduce what an admin can do; it reduces how long a stolen session or credential is worth anything.

| | Standing privilege | Just-in-time (eligible) privilege |
|---|---|---|
| When the access exists | Always | Only during an approved activation window |
| Value of a stolen admin session | Full, indefinitely | Limited to the window, or nothing outside it |
| Audit trail | Membership only | Who activated, why, when and for how long |
| Typical exceptions | None by design | [Break-glass](https://startwithidentity.com/glossary/break-glass/) accounts |

It matters because attackers who phish or buy a credential inherit whatever that account holds right now. Standing privilege is also what accumulates silently: a mover keeps the admin group from the last team, a service account keeps owner rights granted for a one-time migration. Start by inventorying permanent assignments to the highest-impact roles and converting them to eligible ones; leave two monitored break-glass accounts as the only standing exceptions.

See also: [zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/), [least privilege](https://startwithidentity.com/glossary/least-privilege/), [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/), [zero standing privileges rollout](https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/), [zero standing privileges best practices](https://startwithidentity.com/articles/zero-standing-privileges-best-practices/), [mover entitlement accumulation](https://startwithidentity.com/techniques/mover-entitlement-accumulation/)