What is a function of least privilege in Identity and Access Management (IAM)?

Least privilege means users, services, and systems receive only the permissions required to perform their legitimate duties. This reduces risk because a compromised account or misused identity has a smaller blast radius. For example, an employee who only needs to read reports should not have administrator rights to modify databases or deploy code. Temporary access may be part of just-in-time access, but providing temporary access to all users is not least privilege. Granting permission to all resources is the opposite of least privilege. Giving every user the same access level may simplify administration, but it creates excessive privilege and increases exposure. Least privilege should be enforced through IAM policies, RBAC, privileged access management, access reviews, and strong authentication. It is one of the most important identity security principles because many breaches become severe only after attackers obtain accounts with broader permissions than necessary. Reference/topics: Identity Security 7.2.3, least privilege; Identity Security 7.1.5, RBAC.