User access control

User access control makes sure accounts belong only to authorised people, and that each account can reach only what its user needs for their role. Requirements v3.3 asks you to approve accounts before creating them, give each person unique credentials, remove accounts that are no longer needed, keep admin work on separate accounts, and use MFA wherever it is available. Authentication to cloud services must always use MFA.

Why it matters

Every account is a way into your data. Admin accounts are the most valuable, because they can install software, change system settings, and create accounts and grant privileges. If someone opens a malicious link while signed in as an admin, the malware usually runs with admin rights too. That is how one click can let ransomware encrypt a whole network.

The control applies to servers, desktops, laptops, tablets, phones, and IaaS, PaaS and SaaS services. It covers third-party accounts as well: any account your organisation owns is in scope, even when a supplier, contractor or managed service provider uses it to support you.

The requirements, in plain English

Version 3.3 says your organisation must:

1. Have a process to create and approve accounts. Someone with authority agrees an account is needed before it is made. A short written procedure is enough for a small organisation.
2. Authenticate users with unique credentials before they can use applications or devices. One person, one login. Shared logins break accountability.
3. Remove or disable accounts that are no longer needed, for example when someone leaves, or after a set period of inactivity that you define.
4. Use MFA wherever it is available. For cloud services it is not optional. See MFA for cloud services.
5. Use separate accounts for admin work only. Admins use a standard account for email, browsing and everyday tasks, and a separate account for administration.
6. Remove special privileges when they are no longer needed, such as when someone changes role.

You also need to understand how each account authenticates (password, MFA, passkey or single sign-on) and manage that properly. The detailed rules are in passwords and passkeys.

Admin accounts in practice

• Most staff should be standard users, not local administrators on their own computers.
• The separation applies to every kind of admin: local admins, domain admins and cloud admins such as a Microsoft 365 global administrator.
• Keep the list of admins short, and review it regularly.
• In a one-person business you still need two accounts: a standard one for daily work and an admin one for changes.
• Version 3.3 says MFA should always be used for admin accounts and for any account reachable from the internet.

Third parties and IT providers

If an IT provider manages your systems using accounts in your tenant, those accounts are in scope and must meet the same rules. If you use externally managed services, such as remote administration, you must be able to confirm the controls are met and show this in your answers. Ask your provider how they handle their accounts, MFA and admin separation before you sign the declaration.

Common problems

• A shared "office" or "reception" login on a PC or cloud service.
• A leaver's mailbox still active months later.
• The owner's everyday email account is also the Microsoft 365 global admin.
• Staff are local administrators "so they can install things".
• A former IT provider still has an admin account.

What to do

1. Write a one-page joiners, movers and leavers procedure that names who approves accounts.
2. List the accounts on every device and cloud service, and match each to a current person.
3. Disable leavers and dormant accounts. Replace shared logins with individual ones.
4. Create separate admin accounts and remove admin rights from everyday accounts.
5. Turn on MFA for every cloud account, every admin account and anything reachable from the internet.
6. Review the admin list on a schedule, such as every six months.

The readiness checker covers each of these and shows which apply to your setup.