Standing Privilege

Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not the person or workload is using it at the moment. It is the opposite of just-in-time access, and removing it is the goal of zero standing privileges.

Microsoft's Privileged Identity Management documentation makes the distinction precise. A "permanent active" assignment is one "where a user can always use the role without performing any actions": that is standing privilege. An "eligible" assignment requires the user to activate the role, with MFA, a justification or an approval, for a limited period. Microsoft also notes there is no difference in the access granted, only in when it exists. The control does not reduce what an admin can do; it reduces how long a stolen session or credential is worth anything.

It matters because attackers who phish or buy a credential inherit whatever that account holds right now. Standing privilege is also what accumulates silently: a mover keeps the admin group from the last team, a service account keeps owner rights granted for a one-time migration. Start by inventorying permanent assignments to the highest-impact roles and converting them to eligible ones; leave two monitored break-glass accounts as the only standing exceptions.

See also: zero standing privileges, least privilege, privilege escalation, zero standing privileges rollout, zero standing privileges best practices, mover entitlement accumulation