Reaching Zero Standing Privilege

An MSP's admin accounts are the most valuable thing an attacker can take from it, because each one opens a door at every client it touches. Zero standing privilege removes that prize: no account holds admin rights while nobody is using them, so there's nothing sitting live to steal.

This guide is for the people who own the decision at an MSP: owners, CEOs, and the service delivery and security leads who will live with the result. It explains what zero standing privilege means in practice and walks through the eight phases of the PAM journey. It also gives you a scorecard and a set of vendor questions you can use whatever platform you end up running.

What the guide covers

• Why standing admin access is an MSP problem. How one compromised account becomes an incident across a whole client list. The guide walks through three documented MSP incidents from 2021 to 2026 and what governments have told MSPs to do about it.
• The eight phases, one at a time. For each phase of the PAM journey: what it does, what good looks like, where MSPs usually stall and what to ask a vendor.
• What Microsoft already gives you. Windows LAPS, Entra ID PIM and granular delegated admin privileges (GDAP), and exactly where each one stops.
• A 90-day rollout plan. A week-by-week order of work built around a pilot client. It also covers the decisions to make before go-live, so the project doesn't keep losing to billable tickets.
• How to evaluate a PAM platform as an MSP. The criteria analyst reports don't score for MSPs, and five requests that separate a demo from a deployment.
• A scorecard for your own MSP. Score each phase from 0 to 2, then re-run it after 90 days to show clients what changed.

CyberQP sells a PAM platform, so we have an interest in this topic. The method holds whatever tools you use, and the vendor questions apply to us as much as to anyone else.