Zero Standing Privileges: What It Means and How to Get There

Short answer: Zero standing privileges (ZSP) is an access model in which no user or machine identity holds permanent privileged rights. Admin access is granted for a specific task, scoped to what that task needs, approved, and removed automatically when the time window ends. Between tasks, a compromised account has nothing privileged to steal.

What is zero standing privileges?

Zero standing privileges is an identity security principle that removes all permanent privileged access for every human and machine identity, so privileges exist only while an approved task is running. Palo Alto Networks defines ZSP as eliminating "all permanent (standing) access rights for every identity, human or machine" (source).

A standing privilege is any admin right that is always on: a Domain Admins group membership, a permanent Global Administrator role, an AWS user with AdministratorAccess attached, a root SSH key on a jump host. "Zero standing access" is a term some vendors use for the same goal.

How zero standing privileges works

A zero standing privileges request follows the same basic flow in most tools:

1. Request: the admin asks for a specific role on a specific resource and gives a justification.
2. Approve: a policy or a named approver checks the request. Low-risk roles can be policy-approved; high-impact roles need a person.
3. Verify: the tool requires strong authentication, such as MFA, at activation time.
4. Grant: the entitlement is provisioned with an expiry.
5. Use and record: activity is logged, and in PAM tools often session-recorded.
6. Revoke: access is removed when the window closes, without anyone having to remember.

Microsoft Entra PIM documents each of these controls: approval to activate, MFA on activation, justification, notifications, access reviews and downloadable audit history (Microsoft Learn).

Why standing privileges matter for IT teams

Standing privileges turn every stolen credential into a stolen admin session. If a helpdesk engineer's account permanently holds a privileged role, a phished password or a session token taken by infostealer malware carries that role with it, at any hour.

Okta's August 2024 case for zero standing privileges makes this argument around credential theft and infostealers. The underlying data comes from Palo Alto Networks Unit 42, which analyzed more than 680,000 identities across 18,000 cloud accounts and found that 99% of cloud users, roles, services and resources held permissions left unused for 60 days or more (Unit 42, April 12, 2022). The operational point: unused permissions add blast radius without adding productivity. Removing them by default, and granting them back per task, shrinks what an attacker gets from any single compromise.

Key components: time, entitlements and approvals

The TEA model used by Palo Alto Networks and CyberArk splits zero standing privileges into three controls. Each one can be weak on its own.

Zero standing privileges vs just-in-time access vs least privilege

Zero standing privileges, just-in-time access and least privilege overlap, and vendor pages often blur them.

Microsoft's PIM documentation defines JIT as a model in which "users receive temporary permissions to perform privileged tasks," and least privilege as giving each user "only the minimum privileges needed" (Microsoft Learn). ZSP combines both, with documented emergency access as the only exception.

A maturity path from vaulted standing access to ephemeral access

Most organizations reach zero standing privileges in stages. The path below is our own framing of the steps the sources describe:

1. Stage 0, standing and shared: admins use permanent privileged accounts or shared credentials.
2. Stage 1, vaulted standing access: privileged credentials sit in a PAM vault with checkout, rotation and session recording. The privilege still exists permanently; only access to it is controlled.
3. Stage 2, eligible JIT roles: admins hold eligible rather than active assignments and activate for a limited time with MFA and justification, as in Entra PIM. PIM supports both permanent eligible and time-bound eligible assignments, so make eligibility time-bound where you can.
4. Stage 3, scoped JIT: elevation targets narrow roles on specific resources instead of tenant-wide admin.
5. Stage 4, ephemeral access: the entitlement or account is created for the task and removed afterward, so nothing is left to vault or steal. The CSA article notes this does not fit every case, such as tenant-level accounts during SaaS tenant creation.

Watch out: vaulted accounts (stage 1) are still standing privileges, even when an audit counts them as controlled. Stage 2 is the first stage where the privilege itself is not always on.

Common misconceptions about zero standing privileges

• "ZSP is just JIT with a new name." The CSA article addresses this directly: JIT controls timing, while ZSP also constrains entitlements and approvals.
• "ZSP means admins cannot act quickly." Approval can be policy-based for low-risk roles; human approvers are reserved for high-impact ones.
• "ZSP replaces the vault." The CSA article states a complete program still combines vaulting, JIT and ZSP controls.
• "ZSP covers people only." Palo Alto Networks' definition includes machine identities, which often hold the larger share of standing permissions.

Zero standing privileges in practice

Three examples show what zero standing privileges looks like with tools many IT teams already have.

• Microsoft 365 and Azure: Entra PIM turns permanent role assignments into eligible ones with approval and MFA on activation, and prevents removal of the last active Global Administrator and Privileged Role Administrator assignments (Microsoft Learn). PIM requires licensing, which Microsoft covers in its Entra ID Governance licensing documentation; check your tier before planning around it.
• AWS: IAM Identity Center describes temporary elevated access as a way "to request, approve, and track the use of a permission to perform a specific task during a specified time," and lists validated partner solutions including Apono, CyberArk Secure Cloud Access, Okta Access Requests and Tenable (AWS docs).
• Break-glass accounts: every ZSP design keeps at least one emergency path outside the request flow. Protect it with a hardware key, alert on every use and test it on a schedule.

What to look for in a zero standing privileges tool

When you evaluate a PAM or JIT platform for zero standing privileges, check whether it can:

• Grant scoped roles on specific resources, not only tenant-wide admin.
• Expire both the activation and the eligibility.
• Require MFA at activation, not only at sign-in.
• Cover machine identities and service accounts, not only human admins.
• Record sessions and tie each one to its request justification.
• Integrate with your identity provider for approvals and deprovisioning.

The privileged access management category hub lists the vendors covered on this site, and the shortlist builder turns these checks into a list to score vendors against.

Bottom line

If your admins still hold always-on roles, the practical first move toward zero standing privileges is converting them to eligible, time-limited assignments with MFA on activation, using native tools you may already license. Scoped roles and ephemeral cloud access come next. A dedicated PAM platform is worth evaluating once you need the same controls across on-prem servers, databases and machine identities; start with the privileged access management vendors on the category hub.