Privileged accounts: habits for IT admins
Complete plan
Four modules for IT admins, help-desk staff and managed service providers: a dedicated account to administer, verify identity before any reset, approve apps by least privilege, and offline backups that are actually restored. Role-based training for ReCyF requirement 4.5, point 8.2 of the ENISA NIS2 guidance and ISO 27001 controls A.8.2 and A.8.13.
- 9 min
- 4 modules
- 12-question check
- English · Français
- Attestation
You will be able to
- Use a dedicated admin account, never for email or web browsing
- Recognise an impersonation reset request: a real name, urgency, a new phone
- Tell delegated from application permissions, and see what an application permission opens
- Apply the three-two-one rule: three copies, two media, one offline
Programme
4 modules · 9 min-
One account to administer, another to work 2 min
- Use a dedicated admin account, never for email or web browsing
- Keep global administrators to a minimum and prefer narrower roles
- Switch admin rights on only for the task, and protect admin accounts with strong MFA
-
Reset on a simple call? 2 min
- Recognise an impersonation reset request: a real name, urgency, a new phone
- Verify identity before any password or MFA reset: call back a number you already know, confirm through another channel
- Apply a stricter procedure to privileged accounts, limited to a few authorised people
-
Apps that ask for everything 2 min
- Tell delegated from application permissions, and see what an application permission opens
- Approve an app by least privilege: publisher, permissions needed, owner
- Limit user consent, use an approval workflow and review connected apps regularly
-
A backup you've never restored 2 min
- Apply the three-two-one rule: three copies, two media, one offline
- Keep backups separate from the usual network and admin accounts
- Test a restore regularly, from a single file to a whole server, and measure recovery time
-
Knowledge check
12 questions, pass mark 80 %. Explanations after each answer; you can try again.
-
Attestation
One per person, with the date, the score and the frameworks covered — anyone can check it online with its code.
Version 1 · updated October 5, 2026