Skip to content
ENExplore Calculators

Least Privilege Calculator

Score how close an identity is to least privilege by comparing permissions granted against permissions actually used.

About Least Privilege Calculator

Cloud access analysers give you both numbers: what a principal could do and what it did. The gap is the unused privilege you can remove, weighted upward for administrative actions because those carry the largest blast radius, and discounted when a short observation window may simply have missed seasonal work. Unused permissions are the raw material of every privilege-escalation path and lateral-movement step, and they cost nothing to remove compared with the incident they enable.

Formula

Least Privilege

excess rate = (granted − used) ÷ granted, and the score is 100 minus 0.8 × the excess rate minus an administrative-permission penalty, scaled by how long you observed usage.

granted
Permissions the identity holds through every policy and role
used
Permissions exercised at least once in the observation window
windowFactor
Confidence discount when the window is shorter than 90 days

Worked example

With the default values below, Least Privilege Calculator returns Least Privilege Score of 33. Change any input above and every figure here is recalculated in your browser.

Inputs used

Permissions grantedaccepts 1–100,000 permissions
120 permissions
Permissions actually usedaccepts 0–100,000 permissions
34 permissions
Of those granted, administrative onesaccepts 0–10,000 permissions
8 permissions
Usage observation windowaccepts 7–400 days
90 days

Results

Least Privilege Score
33 / 100
Rating
F — Critical
Unused Permissions
86
Excess Permission Rate
71.7%
Granted ÷ Used
3.53 ×
Permissions Safe to Revoke
86

Step by step

  1. 1Values used
  2. 2Least Privilege
  3. 3Least Privilege Score= 33 / 100
  4. 4Rating= F — Critical
  5. 5Unused Permissions= 86
  6. 6Excess Permission Rate= 71.7
  7. 7Granted ÷ Used= 3.53 ×
  8. 8Permissions Safe to Revoke= 86

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Least Privilege calculated?

excess rate = (granted − used) ÷ granted, and the score is 100 minus 0.8 × the excess rate minus an administrative-permission penalty, scaled by how long you observed usage. Cloud access analysers give you both numbers: what a principal could do and what it did. The gap is the unused privilege you can remove, weighted upward for administrative actions because those carry the largest blast radius, and discounted when a short observation window may simply have missed seasonal work.

Why does Least Privilege matter?

Unused permissions are the raw material of every privilege-escalation path and lateral-movement step, and they cost nothing to remove compared with the incident they enable.

What values do I need to enter?

This calculator takes 4 inputs: Permissions granted, Permissions actually used, Of those granted, administrative ones, Usage observation window. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

How long should I observe usage before revoking?

Ninety days is the common default because it covers a quarter-end and most monthly batch jobs. Shorter windows over-report excess — a permission used once a year looks unused in 30 days — which is why the score here is discounted for windows under 90 days rather than treated as equally trustworthy.

Should I revoke everything unused?

Revoke in tranches and keep a rollback path. Start with administrative and data-destructive actions that were never used, move the identity to a scoped-down policy behind a permissions boundary, and keep the old policy detached but intact for a cycle so a break-fix restore is one attach away.

Related Calculators

Least Privilege Calculator – Calculate Least Privilege Score