What is a privileged account?

A privileged account is an account with admin rights: it can change how a system is set up and who may use it.

What does NIST mean by a privileged account?

NIST’s glossary, drawing on SP 800-53 Rev. 5 and SP 800-171r3, defines a privileged account as “a system account with the authorizations of a privileged user.” A privileged user, in turn, is one who is “authorized (and therefore, trusted) to perform security-relevant functions” that ordinary users may not. SP 800-53 gives examples of those functions in its discussion of control AC-6(1): setting up accounts, granting permissions, and choosing which events get logged.

The examples in SP 800-53 lean toward servers and operating systems. It notes that privileged accounts, including super user accounts, usually go by the name system administrator on commercial operating systems. Nothing in the definition limits it to those systems, though. This guide also counts admin accounts for cloud services and SaaS tools (software you use through the browser).

Which accounts count?

Here are four kinds. What each one can do comes from the vendor’s own documentation.

• The account that owns a whole cloud account. The AWS root user has complete access to every service and resource in the AWS account. Some tasks need it, such as closing a standalone account and some billing tasks.
• A SaaS tool’s top admin. A Google Workspace super admin can use every feature in the Google Admin console, manage the other admins, and restore deleted users.
• Microsoft 365’s top admin. Microsoft says a Global Administrator has “almost unlimited access to your organization’s settings and most of its data.” That role can reset any user’s password, manage purchasing, and add and manage domains.
• The admin of a computer itself: the super user and administrator accounts on an operating system, which SP 800-53 mentions.

Logins for a domain registrar or a payment dashboard don’t appear in these sources. This guide counts them anyway, because they can do some of what the top admins above can do, such as changing a domain or where payments go.

Why are privileged accounts handled separately?

They get extra care because a misused privileged account can change everything else. SP 800-53’s discussion of AC-6(9) calls misuse of privileged functions “a serious and ongoing concern,” whether by authorized users or by outside attackers who took over an account. AC-6(5) restricts privileged accounts to specific people or roles, which keeps day-to-day users away from privileged functions.

Vendors say much the same about their own top accounts. AWS strongly recommends keeping the root user out of everyday work. Microsoft recommends having as few Global Administrators as possible. Google recommends at least two super admins, so that one can reset the other’s password.

How is a privileged account different from a shared account?

“Privileged” describes what an account can do; “shared” describes how many people use it. An admin login that several people use is both. Microsoft’s Entra ID documentation gives an example: a single local account with high privileges, used for setup, administration and recovery. What is a shared account? defines the second term. Managing privileged accounts covers how to run both kinds.