How Should We Set Up Vendor Access to Our Production Systems?

A great approach is to set up supervised access through screen sharing tools like Teams. It keeps everything in check and ensures you're aware of any changes happening in real-time.

Definitely need clarity on what 'hosting' means in your situation. If they manage the actual servers, they shouldn’t require AD access. But for application hosting, there would be different access levels needed. Establish what level of control they need and adjust permission settings accordingly.

If the vendor is hosting the system, they likely already have some level of access. But if they need specific permissions, it's crucial to implement some safeguards. One option is to create an Active Directory (AD) account for them. This way, you can monitor their activities and enable the account only when they need access. Also, if the system is sensitive, consider letting them guide you through any changes via a screen share instead of allowing direct control.