About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.
A managed hosting provider looks after the servers, so its staff hold administrator access to them. That access is necessary: it is how patches are applied, faults fixed and backups restored. It is also among the most powerful access to the business's data held by anyone outside the business.
This article explains what good control of that access looks like, using the Australian Signals Directorate's Information Security Manual (ISM) and Microsoft's privileged access guidance, and lists the questions to ask a provider.
Why it matters
ASD states that One of the greatest threats to the security of networks is the compromise of privileged user accounts. A provider's administrator accounts can reach the servers it manages, possibly for more than one customer. How those accounts are issued, protected and recorded decides how much a compromise at the provider would expose, and whether anyone could tell afterwards what was done.
How it works
Few, controlled pathways
Microsoft's privileged access strategy sets two goals: Strictly limit the ability to perform privileged actions to a few authorized pathways, and protect and closely monitor those pathways. Applied to managed hosting, that means administrators reach customer servers through a defined route, such as a hardened management workstation and a management network, not from any device on any network.
The ISM makes the same point about the administrator's own computer. It describes a dedicated Secure Admin Workstation as the most secure way to separate privileged work from everyday work such as email and browsing.
Access limited, named and time-bound
The ISM's controls on privileged access, in its Guidelines for system access, include:
- Privileged access is validated when first requested and limited to what each person needs for their duties.
- Each administrator has a dedicated privileged account, used only for privileged work. Shared accounts are strictly controlled and their users uniquely identifiable.
- Just-in-time administration is used for the administration of systems and their resources. Access is granted for a task and expires, rather than standing permanently.
- Privileged access is disabled after 45 days of inactivity and after 12 months unless revalidated, and removed the same day it is no longer needed.
Strong sign-in
Both multi-factor authentication and restricting administrative privileges are among the eight mitigation strategies in ASD's Essential Eight. The ISM explains that a human user can be authenticated with multi-factor authentication, such as a username, password and security key, or less preferably with a username and password alone. It also advises that access decisions should not rely only on presenting those credentials: signals such as device compliance, privilege level and user behaviour can decide whether to allow access, ask again or refuse.
Logged where the administrator cannot erase it
The ISM states that Privileged access events are centrally logged. Its security assurance guidelines add that event logs are protected from unauthorised access, modification and deletion. For a customer, the practical test is whether a record of who logged on to its servers, and when, exists somewhere the administrator concerned cannot alter.
Break-glass accounts
When normal sign-in fails, for example because the identity service is down or misconfigured, someone still needs to get in. The accounts for this are called break-glass or emergency access accounts. The ISM states that Break glass accounts are only used when normal authentication processes cannot be used. Its further controls: they are used only for specific authorised activities, their use is centrally logged, their credentials are changed by the account's custodian after anyone else uses them, and they are tested after each change.
ASD notes a weakness: actions performed with a break-glass account are not directly attributable to a person, and event logs may not be generated. It therefore expects who used the account, why, and what was done to be documented through change management.
Microsoft's guidance for its Entra identity service recommends two or more emergency access accounts, restricted to genuine emergencies.
What to choose and why
Questions to ask a managed hosting provider:
- Which of your staff can log on to my servers, and are their accounts individual and named?
- Is administrator access standing, or granted per task and expiring?
- From where can they connect: dedicated management workstations and networks, or general devices?
- Is multi-factor authentication required for administrator sign-in?
- Where are logons to my servers logged, can the administrator alter those logs, and can I see them?
- How are break-glass accounts held, who is the custodian, and how is their use recorded and reported to me?
- How quickly is access removed when a staff member leaves?
- Do the same administrator accounts reach other customers' servers?
Answers that match the ISM controls above give a basis for trust. Vague answers, shared accounts or logs only the administrator controls are reasons to ask more before signing.
The customer has a part too: keep its own administrator accounts separate from the provider's, and agree in writing who approves changes.
Risks and limits
- The ISM is written for Australian government systems. Its controls are a useful reference for private businesses, not a legal requirement on them unless a contract or regulation makes it one.
- Controls on paper are not controls in practice. Ask for evidence, such as a sample access report.
- Tighter access can slow emergency work. Just-in-time access and break-glass procedures exist so that speed does not require standing access.
- Logs are only useful if someone reviews them. Agree who looks at them and how often.
- No commands are given here.
Sources
Opened 14 November 2026.
- ASD: Guidelines for system access, Information Security Manual, September 2026.
- ASD: Guidelines for system management, Information Security Manual.
- ASD: Guidelines for security assurance, Information Security Manual (security monitoring section).
- ASD: Essential Eight explained.
- Microsoft Learn: Developing a privileged access strategy; displayed Last updated: 2024-06-20.
- Microsoft Learn: Manage emergency access accounts in Microsoft Entra ID; displayed Last updated: 2026-06-05.
Related service: Managed support.
Related future topics
- Separating application tiers with network rules.
- What "private cloud" means.
- Restricting administrative privileges under the Essential Eight.
Learning notes
- Provider administrator access is necessary and powerful; control and logging decide the risk.
- Limit privileged actions to a few protected pathways.
- Named, just-in-time, expiring administrator access is the ISM's model.
- Privileged access events are centrally logged, in logs the administrator cannot alter.
- Break-glass accounts are for when normal sign-in fails, and each use is logged and documented.
This article was originally published on .