Home/Questions/Access control and privilege/Unique privileged passwords
Access control and privilege

Are master/privileged passwords used to access client systems and IT infrastructure unique and not reused?

Reuse is what makes lateral movement cheap. One recovered password that works in four places is worth more to an attacker than four separate compromises.

Attested, not tenant-verifiable

What the carrier is actually asking

The carrier is asking whether the same privileged password appears in more than one place: across clients, across servers, across environments, or between a local administrator account and anything else. For service providers the question is pointed, because a reused technician credential spans customers.

Why it is underwritten

Credential reuse is the mechanism behind the largest correlated losses in this market. It also defeats containment: an incident response that rotates the compromised credential has not contained anything if the same secret is in use elsewhere. Underwriters ask because reuse converts a single-client event into an aggregation event.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Uniqueness is asserted rather than read, so the useful evidence is structural: the mechanisms that make reuse impossible rather than a claim that it does not happen.

PlatformWhere the setting livesWhat has to be true
Password managerPer-system entries with generated secrets, and any reuse report the product offersGenerated, unique secrets per system, with the vault reporting no duplicates
Microsoft 365Local Administrator Password Solution state for Windows endpointsEnabled, so every device has a distinct, rotated local administrator password managed by the directory
Entra IDCustom banned password list and password protectionOrganisation-specific terms are banned, which removes the predictable pattern families that reuse tends to produce
AzureKey Vault secrets with rotation policies, one secret per consumerApplication credentials are distinct per service rather than a single shared secret across an estate
Client environmentsPer-client administrative credentials, for service providersNo shared technician password across customers. This is the highest-consequence version of the question and it is attested
Local administrator passwords are the classic case

A single local administrator password imaged onto every workstation is textbook reuse, and it is still common. The Windows Local Administrator Password Solution solves it directly and is visible in the tenant, which makes it one of the few parts of this answer you can actually show.

What a defensible yes requires

  • Privileged secrets are generated rather than chosen, so uniqueness is a property of the process.
  • Local administrator passwords are managed and rotated per device.
  • Service provider access uses per-client credentials or, better, federated identity with no shared secret at all.
  • Application secrets are distinct per consumer and rotate on a schedule.
  • A rotation has actually been performed recently, which is the practical test of whether the model works.

How this answer goes wrong

Reuse rarely survives a policy review and frequently survives reality. The pattern that persists is the operational shortcut: a build password used during provisioning that is meant to be changed and sometimes is not, or an emergency credential shared during an outage and never rotated afterwards. Both produce exactly the reuse the question asks about, without anyone deciding to reuse anything.

Frequently asked

How can uniqueness be proven?

Directly, it usually cannot. What can be shown is that secrets are generated by a vault, that local administrator passwords are managed per device, and that rotation happens. Structure is the evidence.

Does this include service accounts?

Yes, and they are where reuse concentrates, because the same account is often configured across many servers by design. Separating them by function is the remediation.

What about break-glass credentials?

Unique per tenant and per environment, held under seal, and rotated after any use. A shared emergency password across environments is reuse at the worst possible privilege level.

Is federated access better than unique passwords?

Considerably, because it removes the shared secret entirely. For service providers, federating technician access is the strongest available answer to this question.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture