im literally losing my mind here at our 30-person company, every employee has local admin rights on their laptop, and a few people have admin access to teh cloud tenant "cuz it was easier". I know this isnt great, and Id like to move toward least privilege.
But I'm worried about the support burden. People install tools, printers, borwser extensions. How have others handled this transition? What did you lock down first and what did you leave alone?
oof for laptops, make teh transition gentle: first build a self-service catalogue of approved software (most endpoint management tools support this), then remove local admin. If ppl can install what they need without admin, most of teh complaints go away. Keep a fast-track process for exceptions. good luck man!
yeahhh we have endpoint management through our cloud suite, but its barely configured. Seven people have global admin in the tenant. Some of them are people who changed roles years ago.
hmmm well. Start with the cloud tenant admnis, not laptops. A handful of global admins with no MFA is a much bigger risk than local admin on a laptop. Reduce to two or three named admin accounts, separate from daily accounts, with strong MFA. That alone removes a lot of risk with little friction. hope that helps :)
@emberpusher-3li Id be pragmatic about developers, taking local admin away from ppl who legitimately install tools all day can cost more in productivity than it gains, some companies keep developers as admins on their own machines but harden everything else: spearate accounts, monitoring, no admin on teh tenant... least privilege should fit the role.
Sign in or create an account to reply.
