Author: Alexander Ivanyuk, Senior Director, Technology
Executive summary
The single most useful security control inside a cloud-protection platform is also the one that costs nothing to turn on: give each technician the narrowest role that fits the job. NIST SP 800-53 control AC-6 calls it least privilege; NIST SP 800-207 Zero Trust Architecture makes it the default posture rather than the exception. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) ships with a catalog of built-in roles for exactly this purpose — one fitted role for almost every operational job.
The headline finding is that today, the catalog is very lightly used. Across all active customer tenants, only about 4.8% have granted even one fitted specialty role alongside the defaults; roughly 95.2% run with no documented specialty role at all. Only about 1.15% have granted two or more — the threshold at which a real working separation-of-duties practice begins to look credible.
A structural fact sits underneath that gap and reshapes how it should be read: about 33.9% of customer tenants carry no local administrator account at all. These are tenants administered entirely from the managing partner level, where the least-privilege decision is made on the partner side rather than inside the customer tenant. Delegation discipline, where it appears, is therefore concentrated in the minority of tenants that are administered locally.
Where delegation does happen, it clusters around a small number of fitted roles. Administrator (protection) leads at about 2.41% of customer tenants, followed by the File Sync and Share roles (1.11% user, 0.94% administrator), read-only administrator (protection) at 0.77%, cyber administrator at 0.58%, and security analyst at 0.1%
Two roles tell the clearest stories about how delegation is actually practiced. Cyber administrator averages about 1.24 named administrators in each tenant that uses it — a focused handful of fitted admins rather than a crowd. Security analyst is the deepest grant on the platform; when Managed Detection and Response is purchased, the role is delegated to roughly 14 named analysts per tenant on average, describing a real working security-operations population rather than a formality.
On the partner side, the picture mirrors the customer side in scale. About 3.35% of partner tenants have granted at least one Partner Portal role; Partner Portal — Administrator is the most adopted of the six at 2%.
Regional adoption rates — a country's active customers holding a role divided by its active customer base — reveal where the discipline has taken hold. Cyber administrator adoption is led by South Africa (14.9%), Mexico (14.3%), Brazil (13.5%), Italy (12%) and the United States (11.7%). Security Analyst adoption is led by Colombia (8%), the United States (6.8%) and Australia (6.29%).
The gap is the story. Specialty roles work — every tenant that uses one is a tenant where a disciplined operator made the effort to narrow privilege — but the vast majority of locally administered customer tenants are not yet using them. There is no virtue in operating from the default administrator role when a fitted one exists; CIS Controls v8 Implementation Group 1 treats role-based least privilege as a baseline, not an advanced practice.
Why roles matter
Role-based access control is not a user-experience nicety. It is the operational expression of three of the oldest and most universally agreed cybersecurity principles: least privilege, separation of duties and accountability. Every modern security standard says the same thing in different language.
NIST SP 800-53 Revision 5 is the reference catalog of security controls used by U.S. federal agencies and adopted by private-sector compliance regimes worldwide. Three controls in the Access Control family are directly relevant: AC-2 (account management — every account assigned to a role), AC-3 (access enforcement), and AC-6 (least privilege — grant the minimum access required).
NIST SP 800-207 Zero Trust Architecture is the operational doctrine: no implicit trust, every access decision verified, privileges granted just in time to the narrowest scope. A catalog of fitted built-in roles is the practical mechanism by which a platform supports this doctrine.
NISTIR 7316 Assessment of Access Control Systems evaluates platforms on the discoverability and granularity of their role catalog. A platform that exposes only a few generic admin roles forces administrators into over-granting; a richer catalog of fitted roles makes least privilege achievable.
ISO/IEC 27001:2022 Annex A 5.15 to 5.18 codify the same principles for organizations pursuing certification: define an access-control policy, manage identity and authentication, and review access rights periodically. Fitted roles make those reviews tractable; a single super-admin account makes them almost impossible. ENISA's guidance for SMEs reaches the identical conclusion for organizations without a dedicated identity team: use the platform's built-in role catalog rather than sharing accounts.
The point of recapping these frameworks is not academic. Using a role catalog is not "what mature security shops do." It is what every organization that takes its endpoint estate seriously is expected to do, by every authority that publishes guidance on the question.
The catalog by job
The built-in role catalog organizes naturally by the operational job it supports. The table below uses the role display names from the Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) documentation. Use it as a "pick the right tool" reference rather than a feature list.
How customers actually use the catalog
The right starting question is how many customer tenants delegate at all. Measured against every active customer tenant on the platform, the answer is about 4.8% — that is the share that has granted at least one fitted specialty role alongside the defaults. Two facts shape how to read the per-role chart below. First, the denominator is the full active customer base, not only tenants that happen to carry a local administrator row. Second, about 33.9% of customer tenants have no local administrator account at all because they are administered from the managing partner level — so the realistic ceiling for local delegation is the roughly two-thirds of tenants that are administered locally.
Note: several documented roles do not appear in the chart because their share of customer tenants is effectively zero. Read-only administrator (Management Portal level), unit administrator, administrator (Cyber Infrastructure) and Advanced Automation administrator exist in telemetry but live almost entirely on partner, folder and unit tenants rather than on customer tenants — they are not customer-side roles.
A few of the customer-side roles deserve highlighting for what their use says about the customer:
- Administrator (protection) and read-only administrator (protection) (2.41% and 0.77% of customer tenants). The most-used fitted admin roles. Together they show that customers who do delegate understand the value of separating the person who runs backups from the person who only reviews them.
- Cyber administrator (0.58% of customer tenants, averaging about 1.24 named administrators where used). The modern fitted admin role for a company with the RMM pack enabled. It exists so an IT lead need not operate from the default company-administrator role to do day-to-day security work.
- Security analyst (0.10% of customer tenants, averaging about 14 named analysts where used). The deepest grant-per-tenant ratio on the platform. When Managed Detection and Response is bought, the analyst role is genuinely delegated to a working security operations team rather than granted as a formality.
- Restore operator (0.08% of customer tenants). The dedicated "I can restore data but cannot change protection configuration" role is useful for help-desk teams who handle restore tickets without needing the broader administrator (protection) role.
- RMM operator (0.02% of customer tenants). A scoped operator role for partner technicians delivering remote monitoring and management: remote desktop sessions, on-demand approved scripts and patches and inventory visibility, but no plan editing and no platform administration.
Partner Portal roles
The Partner Portal is documented as a separate surface with its own role catalog for partner-side delegation. The chart below shows the share of active partner tenants that have granted each Partner Portal role.
The partner-side picture mirrors the customer-side picture in scale. About 3.35% of partner tenants have granted at least one Partner Portal role, and only about 0.74% have granted two or more. Partner Portal — administrator is the most adopted of the six at 2%, followed by basic user at 1.17% and training user at 0.77%. Partner-side delegation discipline is, in proportional terms, essentially the same modest level seen on the customer side.
The adoption gap: Where to do more
The single most important number in this report is the share of customer tenants that do not delegate at all: roughly 95.2% of active customer tenants have granted no fitted specialty role. Only about 4.8% use at least one, and only about 1.15% use two or more. Restricting the count to the fitted administrative and security roles — the ones that carry the separation-of-duties story — the share with at least one is about 3.74%, and the share running a genuine multirole separation (two or more) is about 0.2%.
Two practical takeaways. First, most organizations operating an Acronis tenant locally could narrow their privilege posture this quarter with no software changes: add one or two fitted specialty grants alongside the existing default administrator, then step the default administrator down where it is no longer needed for routine work. Second, because a third of customer tenants are administered entirely from the partner level, a large part of the addressable improvement is a partner decision — the partner chooses which fitted roles its technicians use when they work inside a customer tenant.
Regional picture: Where the disciplined markets are
Raw country counts are misleading on their own — a country with many customers will lead in any role by absolute number, whether or not its customers practice least privilege. The more revealing metric is the adoption rate: the share of a country's active customers that have granted the role. The two charts below rank the fifteen largest active-customer markets by that rate. (These regional rates use a narrower, endpoint-deployed and geolocated customer base as the denominator, so they sit higher than the platform-wide figures above and are best compared with one another rather than against the platform-wide percentages.)
Cyber administrator: The working admin role
South Africa, Mexico and Brazil lead the table, each running fitted cyber administrator on roughly one in seven of their active customers — markets where partners and customers have clearly made role specialization a habit. Italy and the United States follow closely behind. The pattern is not driven by market size: several of the largest markets sit in the middle or lower part of the table, confirming that delegation discipline is a practice choice rather than a function of scale.
Security analyst: Where security delegation is real
Managed Detection and Response is a premium tier, so absolute adoption rates are necessarily modest and the pattern of where the role is genuinely delegated matters more than the level. Colombia, the United States, Australia, the Netherlands and Canada top this list — markets where MDR is not just sold but operated, with the analyst role delegated to a working team. Notably the leaders here differ from the Cyber administrator leaders, a reminder that "uses fitted admin roles" and "operates a delegated security-operations function" are two distinct kinds of maturity.
Conclusions
Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) ships with a role catalog rich enough to support every standard pattern a security team or auditor expects to see — least privilege, separation of duties, accountability through fitted roles and oversight through read-only assignments. The data shows that the catalog works wherever it is used but that it remains lightly adopted: most active customer tenants operate with no fitted specialty role, and only a small minority run the kind of multirole separation that signals a deliberate access-control practice.
A structural feature of the platform shapes that gap and should be read alongside it. A substantial share of customer tenants carries no local administrator at all because they are managed entirely from the partner level. For those tenants the least-privilege decision is a partner decision, which means a meaningful part of the addressable improvement lies in how partners choose to administer the customers they serve rather than in any change a customer must make alone.
Where delegation does happen, the security analyst role tells the most concentrated version of the story. Among customers that have purchased Managed Detection and Response, the role is delegated to a real working analyst population rather than granted as a formality, describing a genuine security-operations function rather than a checkbox. The fitted administrative roles show the same instinct on a smaller scale: where they appear, they appear in the hands of a focused, named few.
Regional adoption rates reveal a coherent geography of discipline. Fitted administrative delegation is led by markets in Latin America, Southern Africa and Southern Europe together with the United States, while delegated security operations are led by a partly different set anchored on Colombia, the United States and Australia. The discipline is a practice choice, not a function of market size — several of the largest markets sit in the middle of both rankings. The action implied throughout is the same and is standards-anchored: the tenants currently operating without a fitted role can move to one this quarter with no software change, which every major framework treats as a baseline expectation rather than an advanced one.
Recommendations
If you are an SMB running your own Acronis tenant
Walk into the access-policy view this week and count how many users hold the default company administrator role. For almost every SMB the right number is one or two — a primary IT lead and a named backup. Anyone else who needs to work in the tenant should hold a fitted role instead: cyber administrator for day-to-day security and IT administration, administrator (protection) for backup and recovery operations, read-only administrator (protection) for anyone who only needs to review, and restore operator for help-desk staff who handle restore tickets. This is exactly the least-privilege and account-management practice prescribed by NIST SP 800-53 AC-2 and AC-6 and by CIS Controls v8 Controls 5 and 6. If the honest answer to the count is "everyone is company administrator because it was easier," that’s the most common mistake on the platform and also the most fixable.
If you are a managed service provider (MSP)
Because a large share of customer tenants is administered entirely from the partner level, the partner-side role decision is where most of the least-privilege bar actually gets set. Three concrete practices distinguish the disciplined partners in the data. Keep a documented role-mapping per customer tier, so that "customer profile X uses cyber administrator plus administrator (protection); profile Y also adds security analyst" becomes a checklist rather than an ad-hoc judgment call. Use the partner-side roles (partner administrator and the Partner Portal series) for your own staff and customer-side fitted roles for access into customer tenants — mixing the two on one identity is the most common audit finding at scale. And review access entitlements per customer quarterly rather than annually; ISO/IEC 27001:2022 Annex A 5.18 and NIST SP 800-53 AC-2 both prescribe this cadence, and the data show that the partners delivering MDR are already operating to it.
If you are a customer working with an MSP
Ask your partner two specific questions. Which built-in roles do their technicians use on your tenant? If the answer is "the default company or partner administrator," request a switch to cyber administrator and administrator (protection) for routine work, with the full administrator role reserved for genuine break-glass situations. And how often are those entitlements reviewed? Quarterly review is the baseline recommended by ISO/IEC 27001:2022 and NIST SP 800-207 Zero Trust Architecture; a partner that cannot answer either question is administering your tenant without the access discipline the standards expect.