A.5.15 Access Control

What is this control?

ISO 27001 control A.5.15 Access Control ensures authorised access and prevents unauthorised access to information and assets through Zero Trust, Deny-by-Default, Least Privilege, and Role-Based Access Control principles. The control enforces identity verification via Conditional Access with MFA, device compliance, and risk checks, privileged access via PIM with Just-in-Time activation, and emergency access via break-glass accounts. All access is treated as untrusted until explicitly verified.

How to implement in Microsoft 365

Implement A.5.15 by deploying Microsoft Entra Conditional Access policies requiring MFA, Intune device compliance, and user risk assessment for all access. Configure PIM to deny standing admin access with all privileged roles assigned as Eligible only. Enforce Just-in-Time role activation via PIM requiring justification and time-limited access.

Configure break-glass accounts with permanent Active roles for emergency access. Exclude break-glass accounts from standard Conditional Access including MFA and device compliance to ensure access during outages. Stream all access logs to Microsoft Sentinel for centralised monitoring.

What an auditor looks for

Auditors will verify that Conditional Access policies are active for MFA, device compliance, and risk assessment. They will check PIM configuration showing all privileged roles are assigned as Eligible rather than Active for standard users. Auditors will review break-glass account configuration with permanent active roles via PIM Groups.

They will verify Conditional Access exclusions for break-glass accounts. Auditors will confirm Sentinel data connectors are connected for Entra ID, PIM, and FortiAnalyzer logs. They will review PIM audit logs showing JIT activations with justifications.

Related controls

• A.5.17
• A.8.5