How to tell whether you have this
Open your tenant and count how many accounts hold administrative roles, and how many roles the main one holds. That is a ten-minute job and you can do it without me.
Most people find more than they expected. If nobody can tell you when those assignments were last reviewed, or who reviewed them, that is the finding rather than the number itself.
Why it happens
Nobody grants ninety-odd privileged roles deliberately. They accumulate. A role to solve a problem, another for a migration, another because a vendor asked for it mid-implementation, and no step anywhere that would ever take one away again.
Privileged sprawl is invisible from the inside for exactly that reason. Every individual grant had a justification, so nothing looks wrong until somebody counts the total.
Why it usually stays that way
The honest reason firms leave it alone is not negligence. It is a well-founded fear of locking themselves out of their own tenant while tightening it, usually on a Friday, usually with nobody to call.
That fear is the actual blocker, and it is the first thing I would deal with.
How I would approach it
- Count what is actually assigned, before touching anything. The number is the argument for doing the rest.
- Build the escape hatch first. Break-glass administrator accounts with sealed credentials, a deliberate conditional access exclusion and their own sign-in alerting. Until that exists, nothing else is safe to do.
- Reduce, in order of risk, rather than all at once.
- Stage phishing-resistant MFA through report-only conditional access so the impact is measured before anything is enforced. Nobody gets locked out finding out.
- Review the endpoint side, since access controls on unmanaged devices are decorative. Compliance policies, settings-catalog baselines, attack-surface reduction, and BitLocker key escrow actually verified.
- Set the cycle that stops it drifting back, and reconcile any uplift tracker you already keep against what is genuinely deployed.
What you end up with
Accurate answers to the three questions nearly every security questionnaire asks. Is administrative access limited to those who need it. Is it reviewed, and on what cycle. Is privileged access protected by multi-factor authentication that resists phishing.
Before this kind of work the honest answers are usually no, never and no, while the compliance manual says least privilege and nobody has checked.
Control design here aligns to ISO 27001 and 27701 and to the Essential Eight. Alignment is the accurate word and I use it deliberately, because it is not the same claim as certification.