# Ensure Vercel team follows least privilege with a limited number of owner roles

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262006398848-ensure-vercel-team-follows-least-privilege-with-a-limited-number-of-owner-roles
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure only a small number of trusted administrators, typically two or three for backup, have the Owner role on the Vercel team. All other members should have the lowest role that still allows them to do their work, such as Member, Developer, Viewer, Billing, or Security.

**Rationale**

Owners have full control of the team, including billing, members, security settings, and every project. Each extra Owner is another account that an attacker could use to take over the whole team. Keeping the number of Owners small follows least privilege while still avoiding a single point of failure.

**Impact**

-   Reduces the number of accounts with full team control
    
-   Limits damage if an account is compromised
    
-   Supports least-privilege access
    

**Default Value**

By default, the user who creates the team is an Owner, and Vercel does not limit the number of Owners.

**Pre-Requisites**

-   Team Owner role
    
-   A list of users who need the Owner role
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Open Settings in the sidebar and select Members.
    
4.  Count the members with the Owner role.
    
5.  If more members are Owners than required, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Open Settings in the sidebar and select Members.
    
4.  Select Manage Role next to a member who does not need the Owner role.
    
5.  Choose a lower role, such as Member or Viewer, and save.
    
6.  Keep at least two Owners so the team is not locked out.
    
7.  If Directory Sync is enabled, change the role mapping in the identity provider instead.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Open Settings in the sidebar and select Members.
    
4.  Select Manage Role next to the member, choose Owner, and save.
    

**Reference**

-   [https://vercel.com/docs/rbac/managing-team-members](https://vercel.com/docs/rbac/managing-team-members)
    
-   [https://vercel.com/docs/rbac/access-roles](https://vercel.com/docs/rbac/access-roles)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.