What is least privilege?
Also known as: principle of least privilege, PoLP
Least privilege is the security principle that every user, application, and AI agent should have only the access strictly needed to do its job, and no more. Applied to Microsoft 365 and the AI tools around it, it means scoping permissions tightly, removing standing access that is not used, and reviewing grants regularly. Least privilege is the structural defense against oversharing and against an AI surfacing data it should never reach.
Least privilege is easy to state and hard to hold. Access is granted for a reason, then the reason expires while the access remains, and over months the gap between what people and tools can reach and what they should reach widens into risk.
It is also the most durable defense in the AI era. An assistant or agent inherits the access of the identity behind it, so tight, regularly reviewed permissions are what keep AI from surfacing data it was never meant to see. Least privilege is less a one-time project than a habit: scope tightly, remove unused access, and review on a cadence.
