MSP Access Control Policies: Securing Who Gets In

Your MSP holds the keys to dozens of client environments. Administrative passwords, domain admin accounts, RMM access, VPN credentials — these are the keys to your clients' businesses. If those keys fall into the wrong hands, the consequences are catastrophic.

Access control is the practice of ensuring only the right people have access to the right resources — and only for as long as needed.

Why Access Control Is Uniquely Critical for MSPs

MSPs present an amplified access control challenge:

• Concentrated access. A single compromised MSP technician account can provide access to dozens of client environments.
• Privileged access. MSP technicians typically need administrative access to client systems — the highest level of privilege.
• Multiple environments. Each client environment is a separate security domain, but access is often managed through a single MSP identity.
• Third-party access. Vendors and subcontractors also need access, adding complexity.
• Insider risk. Departing employees may retain access longer than they should.

Access Control Framework for MSPs

1. Identity Management

Every person and system accessing your environments needs a verified identity:

• Unique accounts. Every user must have their own account. Shared accounts are prohibited — they eliminate accountability and make access revocation impossible.
• Multi-factor authentication. MFA on every account, every time. No exceptions. Our Essential 8 Implementation Checklist covers MFA requirements in detail.
• Strong passwords. Minimum 16 characters for standard accounts, 20+ for privileged accounts. Use a password manager — never store credentials in documents or spreadsheets.
• Identity lifecycle. Automated provisioning and deprovisioning. When someone joins, they get access. When they leave, access is revoked immediately.

2. Least Privilege

Grant the minimum access required:

• Role-based access. Define roles with specific permissions and assign users to roles rather than granting individual permissions.
• Client-level segmentation. Technicians should access only the clients they manage, not all clients indiscriminately.
• Time-limited access. Grant elevated access only when needed and revoke it automatically after a defined period.
• Just-in-time access. For privileged operations, grant access on demand with approval, not as a standing permission.

3. Privileged Access Management (PAM)

Privileged accounts require additional controls:

• Credential vaulting. Store privileged credentials in a secure vault (CyberArk, HashiCorp Vault, Azure PIM) rather than in IT Glue or spreadsheets.
• Session recording. Record privileged sessions for audit and forensic purposes.
• Just-in-time elevation. Technicians request elevated access when needed, with time limits and approval workflows.
• Privileged access workstations. Use dedicated, hardened workstations for privileged operations — not the same workstation used for email and browsing.

4. Network Access Control

Control how and from where access occurs:

• VPN requirements. All remote access to client environments must go through VPN with MFA.
• IP restrictions. Where possible, restrict access to known IP ranges.
• Network segmentation. Separate client environments from each other and from internal MSP infrastructure.
• Zero trust architecture. Move toward zero trust where every access request is verified regardless of source.

5. Access Reviews

Access must be reviewed regularly:

• Quarterly access reviews. Review who has access to what and remove unnecessary permissions.
• Immediate review on role change. When someone changes roles, review and adjust their access.
• Termination procedures. Immediate access revocation upon termination, including all client environments, VPN, email, and tools.
• Audit logging. Log all access events and review logs regularly for anomalies.

Common Access Control Failures

• Shared accounts. "admin@client.com" used by multiple technicians eliminates accountability.
• Standing privileged access. Technicians with permanent domain admin access across all clients.
• No MFA. Administrative accounts without multi-factor authentication.
• Slow deprovisioning. Departing employees retaining access for days or weeks after leaving.
• Password reuse. Same password used across multiple client environments.
• Unmanaged third-party access. Vendors with persistent access that is never reviewed.

Building Your Access Control Policy

Your policy should document:

1. Account management. How accounts are created, modified, and deleted
2. Authentication requirements. Password standards, MFA requirements, SSO configuration
3. Authorisation model. Role-based access definitions and permission levels
4. Privileged access procedures. How privileged access is requested, approved, and monitored
5. Access review cadence. How often access is reviewed and by whom
6. Incident response. What to do if access control is suspected to be compromised

Related Guides

• Essential 8 Implementation Checklist — Access control as part of Essential 8
• MSP Cybersecurity Certifications — Security standards requiring access control
• MSP Risk Management Framework — Risk assessment for access control
• MSP Vendor Management Guide — Third-party access management
• MSP Incident Response Plan — Responding to access control incidents