Standing administrator privileges are the structural weakness in the power industry's identity platform

The uncomfortable starting point

Most Norwegian energy companies have a tenant in Microsoft Entra ID where somewhere between five and thirty people hold some form of permanent elevated privilege. Some are Global Administrator. Several are User Administrator, Exchange Administrator, Intune Administrator or Groups Administrator. A couple of them are former consultants who no longer invoice the company, but who still hold the role because nobody has dared to remove it.

This is not a description of a badly run organisation. It is the normal state, and it is a consequence of how the platform is built: an Entra role is a durable property of an account, not a time-limited authorisation tied to a specific task. The role exists because someone once needed to do something. It does not disappear when the task is finished.

Microsoft itself is clear about the desired state. The recommendation in Entra's security planning documentation is that administrators "are doing their day-to-day business as unprivileged users", that privileged access is granted "only when needed, and remove it afterward (just-in-time)", and that there should exist exactly two permanent accounts with Global Administrator — the emergency access accounts, which do not belong to named individuals and are used only when everything else is unavailable.

The gap between this recommendation and the reality in an average Norwegian power company is wide. The question is why, and what actually closes it.

Why just-in-time has not solved the problem

Microsoft's own answer to standing privileges is called Privileged Identity Management. PIM lets a role be assigned as eligible rather than active: the user has the right to activate the role but does not walk around holding it. Activation can require a justification, approval and MFA, and it expires after a defined period.

It is a good mechanism. It has three limitations that are worth understanding precisely before basing a control regime on it.

First, it is licensed in a way that makes broad rollout expensive. Microsoft's documentation is explicit: "You need either Microsoft Entra ID Governance licenses or Microsoft Entra ID P2 licenses to use PIM and all of its settings." The licence requirement applies not only to the person holding the privileged role, but also to those who approve activation requests. At list price as of 19 August 2026, Entra ID P2 is USD 10.00 per user per month with an annual commitment, and Entra ID Governance is USD 7.00 per user per month as an add-on. For a group with several companies and a service desk function that needs to be able to approve requests, this quickly becomes a significant line item.

Second, PIM covers roles, not actions. PIM administers Microsoft Entra roles, Azure resource roles, and group membership through PIM for Groups. That is the entire scope. A first-line employee who needs to add a new operations engineer to the right security group, reset an authentication method, and assign a licence must either hold a role that gives them the right to do all of that — and much more — or hand the task off. PIM makes the authorisation time-limited. It does not make it narrower. A User Administrator who has activated the role for two hours is a fully-fledged User Administrator for two hours, with everything that implies for the entire directory.

Third, activation is not the same as control over what was actually done. PIM logs that the role was activated with a justification. What was subsequently actually carried out in the directory sits in the audit log as separate events, with no structural link back to the justification. Proving after the fact that change X was the change justification Y referred to is manual correlation work.

What the regulations actually require

For KBO entities this is not an academic discussion. § 7-4 of the Power Supply Preparedness Regulations (kraftberedskapsforskriften, FOR-2012-12-07-1157) on control of user access sets out a concrete requirement: undertakings shall verify that only rightful users have access to the operational control system, control arrangements shall exist for granting, changing and deleting user access, and these control arrangements shall be reviewed at least annually. The Regulations were last amended with effect from 1 July 2026; the amendment concerns repair preparedness under § 4-1 and does not affect the wording of § 7-4.

The requirement applies to the operational control system, not the office domain. But it is a precise description of the level of maturity the supervisory authority expects in the part of the business that matters most — and it is difficult to argue convincingly that an undertaking has control over granting, changing and deleting user access in the operational control system if that same undertaking does not have it in the identity platform that governs almost everything else, including the accounts of the people who have access to the operational control system.

the Basic Principles for ICT Security published by the Norwegian National Security Authority (NSM), version 2.1 of 31 May 2024, are more explicit at the general level. Principle 2.6, "Maintain control of identities and access" (author's translation from the Norwegian; Norwegian: "Ha kontroll på identiteter og tilganger"), aims for the undertaking to "have an overview of identities and accounts in the information systems, and manage access to resources effectively and in accordance with the undertaking's guidelines" (Norwegian: "har oversikt over identiteter og kontoer i informasjonssystemene og styrer tilgang til ressurser effektivt og i henhold til virksomhetens retningslinjer"). Measure 2.6.1 requires guidelines built on the principle of least privilege with traceability to the responsible person. Measure 2.6.2 requires a formal process for the entire lifecycle — creation, maintenance, deactivation. Measure 2.6.3 requires a centralised, automatable tool for managing accounts, access and privileges.

Note the wording in 2.6.3. NSM is not asking for a procedure in a quality management system. NSM is asking for a tool.

What actually happens when an administrator account is taken

The attack pattern is well documented and tediously predictable.

Norsk Hydro, March 2019: the entry point was a weaponised email attachment sent from an employee at a trusted customer. The identity problem itself came afterwards — the attackers escalated to administrative privileges, gained control of the domain controllers, and distributed LockerGoga across the entire infrastructure. Hydro's own updated cost estimate is around NOK 800 million. The initial compromise was not identity-related. The scale of the damage was.

Colonial Pipeline, May 2021: a VPN account with a password that appeared in a leaked password list, with no multi-factor authentication, on an old profile that was not meant to be in use. One account nobody owned, that nobody had deactivated.

Midnight Blizzard against Microsoft, January 2024: a password spray attack against an account in a legacy test tenant that was not subject to current security standards. Microsoft's own phrasing is that the attack "was not the result of a vulnerability in Microsoft products or services." It was an account that should no longer have existed.

The recurring pattern is not sophisticated exploitation of platform vulnerabilities. It is accounts and privileges that existed without anyone still knowing why.

A different model: authorisation to act, not to a role

The alternative to assigning roles is to assign actions. Instead of a service desk employee being given User Administrator so they can reset an authentication method, they are given the right to request that an authentication method be reset — for a defined population of users, with a justification, through a flow that is approved and then executed by machine.

This is the model Entra Logic is built around. The consequences are structural, not cosmetic:

No human holds standing privileges in the directory. Execution happens through a central engine that runs PowerShell against Microsoft Graph. The people in the organisation have the right to request changes and the right to approve them. They do not have the rights to execute them themselves. A compromised service desk account can submit a request. It cannot change the directory.

What was approved is what gets executed. Because there is no manual intermediate step between decision and action, there is also no gap between what was approved and what a technician actually typed into the console at 11pm on a Friday.

Business justification, approval and technical execution are the same record. Not three trails that must be manually correlated during an audit by the authority — one order with the entire history.

Secure by default. Where entitlement cannot be confirmed, the action is not shown. The safe choice is the default, not dependent on someone having remembered to configure a policy correctly.

It is worth being precise about what this is not. Entra Logic is not a certification or attestation product. It does not run recertification campaigns and does not perform segregation-of-duties analysis. It does one thing: it ensures that changes in the identity platform happen through a governed, approved and auditable flow instead of through permanent administrator privileges. For most Norwegian energy companies, that is precisely the problem that remains unsolved.

What you should do this week, regardless of vendor choice

1. Count the number of accounts with active privileged roles in the tenant. Not eligible — active. Compare against Microsoft's recommendation of two permanent Global Administrator accounts.

2. Identify which of these belong to people who no longer have the task the role was granted for.

3. Check whether the emergency access accounts actually exist, whether they are excluded from conditional access policies that would otherwise block them, and whether anyone has tested that they work in the past twelve months.

4. Assess whether the organisation can answer the question "who approved this change, and why" for a randomly chosen directory change from last quarter — in under ten minutes.

Point four is what determines how an audit by the authority goes.

Sources

• Power Supply Preparedness Regulations (kraftberedskapsforskriften, FOR-2012-12-07-1157), §§ 6-3, 7-4 — https://lovdata.no/dokument/SF/forskrift/2012-12-07-1157
• NSM, Basic Principles for ICT Security v2.1 (31.05.2024), principle 2.6 — https://nsm.no/getfile.php/1313975-1717589722/NSM/Filer/Dokumenter/Veiledere/NSMs%20Grunnprinsipper%20for%20IKT-sikkerhet%20v2.1.pdf
• Microsoft, Secure access practices for administrators in Microsoft Entra ID — https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning
• Microsoft, Microsoft Entra ID Governance licensing fundamentals — https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals
• Microsoft, Set up Privileged Identity Management — https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
• Microsoft Entra pricing, retrieved 19.08.2026 — https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
• Norsk Hydro on the cyberattack (cost estimate approx. NOK 800 million) — https://www.hydro.com/en/global/media/on-the-agenda/cyber-attack/
• Bloomberg on Colonial Pipeline (compromised VPN account without MFA) — https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password
• MSRC, Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard — https://www.microsoft.com/en-us/msrc/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard