How to restrict what administrators and techs can access
Technicians and other administrators frequently have the ability to access, edit, or delete client Global Admin accounts and dumb down security settings to make their work easier. Enforcing least privilege requires specific controls, such as a plugin to block out certain sections and security-related settings.
Core Friction Pattern
Analysis of 4 peer accounts across online developer and community forums reveals that “How to restrict what administrators and techs can access” repeatedly surfaces due to edge-case mismatches between standard defaults and real-world environments. Standard troubleshooting frequently falls short, compelling practitioners to develop custom workarounds.
+5 alternative community-tested workarounds cataloged below.
What the numbers show
Counted from the threads quoted below. How we count
- This comes up 120.7× more often in r/msp than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
How to restrict what administrators and techs can access
- 1limiting tool access and using read-only connectorsDid this help you?
- 2implementing least privilege access and role-based segregationDid this help you?
- 3using alternative automation platforms or restricted management toolsDid this help you?
- 4using role editor plugins to modify permissionsDid this help you?
- 5creating custom roles with limited capabilities instead of trimming the administrator roleDid this help you?
- 6avoiding giving the admin role to users and assigning restricted custom roles insteadDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“every tech is able to access/edit/delete client Global Admin accounts, like break-glass.”source ↗
“It takes time but implement least privileged access is the correct answer.”source ↗
“Most of my techs don't have access to CIPP directly.”source ↗
“trying to block other admins from security related plugins and settings, as they dumb down settings to facilitate their work”source ↗
“I'm looking for a WordPress plugin that will control what what administrators have access too. I want to be able to block out certain plugins and other sections of WP.”source ↗
Where this came up
People with this problem also raised
- 3Why won't senior staff let junior admins do anything?
- 3How to map and consolidate scattered user permissions?
- 8Do mandatory passkeys bypass traditional two-factor authentication?
- 2How to fix users incorrectly given admin privileges
- 3Why do former employees still have active logins?
- 2How to learn actual Linux system administration basics