A company developed a web application which is sold as a Software as a Service (SaaS) solution to the customer. The application is hosted by a web server running on a specific operating system (OS)…

Administrative privileges on the OS would grant far broader access than needed, including the ability to modify system files, install software, or alter configurations, which violates the principle of least privilege.

Administrative privileges on the web server would allow the support team to modify web server configurations, restart services, or alter hosted content, which is excessive for simply reading application logs.

Administrative privileges on the hypervisor would grant control over all virtual machines on that host, representing the highest and most dangerous level of over-privileged access, completely unnecessary for log review.

Granting administrative privileges only on the application folders where logs reside follows the principle of least privilege, giving the support team exactly what they need - read access to log files - without exposing broader system resources. This minimizes the attack surface and limits the potential damage from credential compromise or misuse. In a SaaS context, support teams should never require OS-level or hypervisor-level access just to review application logs.