A.5.15 Access Control

What is A.5.15 Access Control?

ISO 27001 control A.5.15 Access Control ensures authorised access and prevents unauthorised access to information and assets through Zero Trust, Deny-by-Default, Least Privilege, and Role-Based Access Control principles. The control enforces identity verification via Conditional Access with MFA, device compliance, and risk checks, privileged access via PIM with Just-in-Time activation, and emergency access via break-glass accounts. All access is treated as untrusted until explicitly verified.

How to implement A.5.15 in Microsoft 365

Implement A.5.15 by deploying Microsoft Entra Conditional Access

Implement A.5.15 by deploying Microsoft Entra Conditional Access policies requiring MFA, Intune device compliance, and user risk assessment for all access. Configure PIM to deny standing admin access with all privileged roles assigned as Eligible only.

Enforce Just-in-Time role activation via PIM requiring justification

Enforce Just-in-Time role activation via PIM requiring justification and time-limited access. Configure break-glass accounts with permanent Active roles for emergency access. Exclude break-glass accounts from standard Conditional Access including MFA and device compliance to ensure access during outages. Stream all access logs to Microsoft Sentinel for centralised monitoring.

What an auditor checks for A.5.15

• Auditors will verify that Conditional Access policies are active for MFA, device compliance, and risk assessment.
• They will check PIM configuration showing all privileged roles are assigned as Eligible rather than Active for standard users.
• Auditors will review break-glass account configuration with permanent active roles via PIM Groups.
• They will verify Conditional Access exclusions for break-glass accounts.
• Auditors will confirm Sentinel data connectors are connected for Entra ID, PIM, and FortiAnalyzer logs.
• They will review PIM audit logs showing JIT activations with justifications.

Related controls

• A.5.17
• A.8.5

Evidence we surface for A.5.15

For A.5.15 we collect your Microsoft Entra Conditional Access policy inventory (the gate), the PIM eligibility configuration (the time-bound elevation), and the break-glass account configuration (the controlled exception). An auditor sees access is governed by policy, elevated only when needed, and recoverable when the primary path fails — three properties they will look for explicitly.

Related insights

• Compliance as a Moat Why genuine ISO 27001 compliance — not certification theatre — is one of the strongest competitive advantages an MSP can build.