MSPs are entrusted with powerful accounts inside their customers' environments. That access allows technicians to resolve issues quickly, keep operations moving, and support customers at scale. But it also creates an important question: who has access to what, for which customer, and for how long?

As identity becomes a primary security boundary, technician access is no longer just an operational concern. It's a critical part of how MSPs manage risk, maintain customer trust, and demonstrate accountability across every environment they support.

Customers rely on that access to keep their businesses running. But MSPs also need confidence that administrative privileges are available only when needed and only to the people authorized to use them. A compromised technician account can place multiple customer environments at risk simultaneously.

Why attackers target technician accounts

A technician may support dozens of customers through the same management platform, making technician accounts some of the most valuable targets in an MSP's ecosystem. The challenge isn't simply credential security. It's the concentration of authority. If attackers compromise an account with broad administrative rights, they may be able to reach multiple customer environments through a single intrusion.

The more broadly access is distributed and the longer it remains available, the greater the potential impact if something goes wrong. Separating customer environments and limiting technician permissions can help contain that risk.

Cybersecurity agencies from the U.S., U.K., Australia, Canada, and New Zealand addressed this risk in a joint advisory issued in 2022. They recommended that MSPs treat all accounts with access to customer environments as privileged and protect them with multifactor authentication (MFA).

More recent research reinforces the need to manage third-party access. Barracuda’s February 2026 Managed XDR Global Threat Report found that 66% of incidents its team handled during 2025 involved the supply chain or a third party, up from 45% in 2024. Verizon’s 2026 Data Breach Investigations Report found credential abuse in 39% of breaches when counted at any stage of the attack. These findings address broader risks than technician access alone, and they show why providers need to control both credentials and the permissions associated with them.

Why access governance matters

Standing privileges are administrative rights that remain available between tasks. They often persist because technicians need to resolve tickets quickly. An account that always has the necessary permissions can seem convenient until someone misuses it.

Several common practices increase that exposure:

• Former technicians and vendors may retain access. Shared admin passwords and local accounts can remain usable after a technician leaves. Barracuda documented an Akira ransomware attack that began through an account created for a third-party vendor and never deactivated after the vendor left.
• Shared credentials obscure accountability. When customer IT staff and MSP technicians use the same admin credentials, logs may identify the account without identifying the person who made the change. Co-managed environments need individual accountability and clear responsibility for approving and revoking access.
• MFA alone does not limit permissions. Attackers can steal authenticated sessions or deceive users into approving login requests. MFA remains essential, and phishing-resistant methods are stronger. But standing admin rights can make a successful compromise much more damaging.
• Access expands as responsibilities change. A technician who takes over an account or helps during an outage may receive additional rights that nobody later removes. Regular reviews should check whether those permissions are still necessary.

Greg Gage

Give technicians access for the work at hand

The goal isn't to make access harder. It's to make access intentional.

Privileged Access Management (PAM) helps MSPs balance operational efficiency with security by ensuring technicians receive the administrative access they need when they need it, and not long before or after.

Least privilege starts with a straightforward question: what level of access is required for a technician to perform a specific task?

Not every technician needs domain administrator privileges across every customer environment. A technician deploying approved software may require temporary permissions for a specific activity without requiring permanent control over the broader environment. As responsibilities evolve, permissions should evolve with them.

Just-in-time access replaces persistent administrative rights with temporary elevation for approved work. Your access policies determine the required authentication and approval, the permissions granted, and how long those permissions last. This reduces the time an account holds administrative rights, limiting an attacker’s opportunity to misuse those rights.

Temporary access doesn't eliminate risk. It changes the risk profile by reducing the amount of time elevated permissions are available. MSPs should still verify how privileges expire, how sessions are handled, and whether access can persist longer than intended through cached permissions or active sessions.

Automated credential rotation changes managed admin passwords after use or on a defined schedule, reducing how long an exposed password remains useful. Rotation does not undo actions an attacker has already taken or necessarily terminate an existing session. Suspected compromise still requires investigation and revocation of affected access.

Individual technician identification and activity logs make these controls easier to review. You should be able to establish who received access, which customer and system were involved, and what the technician did.

Build access controls around support workflows

Security controls are most effective when they align with how technicians actually work.

During an outage or high-priority incident, technicians need a reliable path to approved access. When processes become overly complicated, teams naturally look for shortcuts. The goal should be to build access governance into support workflows rather than around them.

When you evaluate PAM tools, look for separation between customer tenants, individual accountability, straightforward offboarding and compatibility with your existing support workflows. Technicians should be able to select the correct customer and obtain the access their task requires without repeatedly switching systems.

Evo Security, which Barracuda acquired in July 2026, is one example. Built for MSP operations, it offers technician elevation with just-in-time access and automated password rotation, managed through a multi-tenant dashboard. Barracuda has announced plans to embed Evo’s technology into BarracudaONE.

Where to start

Like many identity initiatives, the best starting point is visibility.

Review standing administrative access across your management platforms and the customer environments you support. Document who owns each account, what systems it can reach, and whether that level of access is still justified.

From there, identify a manageable set of routine workflows and pilot just-in-time access. Focus on creating a process that technicians can adopt easily while still maintaining accountability and oversight.

As the program matures, metrics such as approval times, exceptions, and failed requests can help identify friction points and opportunities for refinement. Before expanding deployment, verify that permissions expire as intended and that activity can be traced to an individual technician, customer environment, and action.

Make technician access part of your security program

MSPs routinely help customers strengthen authentication, remove unnecessary permissions, and improve identity security. Applying those same principles internally is becoming equally important.

Identity resilience is no longer just about protecting credentials. It's about ensuring that access is governed, accountable, and appropriately constrained, even when those privileges belong to trusted technicians.

Customers increasingly evaluate third-party risk, operational maturity, and security governance alongside technical expertise. MSPs that can demonstrate disciplined access controls strengthen not only their security posture but also customer confidence.

Standing administrative rights may feel convenient, but lasting trust comes from knowing exactly who can access a customer environment, why that access exists, and how quickly it can be removed when circumstances change.

Greg Gage is head of identity engineering at Barracuda Networks.