Direct answer
Create dedicated, time-limited assessment accounts for the roles and boundaries in scope, with safe test data and an owner. Track access during the engagement and revoke credentials, sessions and temporary privileges when the work ends.
Map required roles
List the user, administrator, support and tenant roles relevant to the agreed tests. For a cross-tenant invoice check, prepare two isolated accounts and one harmless invoice owned by each. Document which actions each account should be allowed to perform.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Provision safely
Use organization-approved account creation, least privilege and secure credential delivery. Avoid sharing personal employee accounts or placing passwords in tickets. Agree how multifactor authentication, session expiry and account lockouts will be handled during testing.
- Identify account owner, role, environment and expiration.
- Use fixtures rather than unrelated customer data.
- Provide a support contact for access problems.
Track changes and constraints
If a role changes or a test account becomes unavailable, record the time and effect on coverage. A scanner that loses authentication may continue finding public pages while missing protected routes; verify the authenticated session and review tool output rather than assuming signed-in coverage.
Reference: OWASP Web Security Testing Guide.
Close access deliberately
At the end, disable accounts and temporary access, revoke tokens or active sessions according to the identity system, and remove test records where permitted. Keep a minimal audit trail linking the account to the engagement without retaining its secret.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Assessment limits
Test accounts represent the roles and data provided, not every permission path. Some access or token revocation behavior depends on the identity provider and application's session design.
Frequently asked questions
Can a tester use an employee's ordinary account?
Dedicated test accounts are preferable because their scope, ownership and retirement can be controlled. Follow the organization's access policy.
Does an account with administrator access cover all user roles?
No. Privileged behavior can differ from ordinary user and cross-tenant behavior, so supply the specific roles needed.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.