The Holy Grail is zero permanent members of any elevated group as much as possible. Use just-in-time credentials, two-factor authentication and least-privilege delegation. Delegate, delegate, delegate delegate is the way to go I don’t care how you get there, I dont care how there is there. Two-factor authenticating credentials is one of the best strategies any company can deploy, says John Defterios. He says the new requirement that all administrative credentials are entered and performed administrative tasks are all entered.”]
Source: https://www.csoonline.com/article/3030269/5-tips-to-protect-your-admin-credentials.html