(L1) Ensure that between two and four global admins are designated

Contributed by Ben Miles with AnasAll contributors →

Part of CIS · Microsoft 365 · Administrative accounts · All checks

Run this check

Invoke-Maester -TestId CIS.M365.1.1.3

Overview

1.1.3 (L1) Ensure that between two and four global admins are designated

Between two and four Global Administrators should be designated in the tenant. Ideally, these accounts will not have licenses assigned to them which supports additional controls found in this benchmark.

The check counts unique users with an active or eligible Global Administrator assignment, including members of role-assigned groups. It reports an error if a group’s members cannot be read.

Rationale

The Global Administrator role grants unrestricted access across all services in Microsoft Entra ID and should never be used for routine daily activities. Limiting the number of Global Administrators reduces the attack surface of the tenant and aligns with the principle of least privilege.

Fewer than two Global Administrators creates a single point of failure and removes the peer oversight needed to detect unauthorized actions. More than four increases the likelihood of account compromise by an external attacker. Maintaining between two and four Global Administrators balances operational redundancy against privileged access risk.

For any accounts assigned the Global Administrator role, at least one strong authentication method such as a FIDO2 key or certificate is strongly advised.

Impact

The potential impact associated with ensuring compliance with this requirement is dependent upon the current number of Global Administrators configured in the tenant. If there is only one Global Administrator in a tenant, an additional Global Administrator will need to be identified and configured. If there are more than four Global Administrators, a review of role requirements for current Global Administrators will be required to identify which of the users require Global Administrator access.

Remediation action

Note: If an organization’s tenant is using a third-party identity provider, this remediation may not be relevant. The principle of the recommendation is still relevant, and compensating controls that are relevant to the third-party identity provider should be implemented.

To correct the number of global tenant administrators:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Select Users > Active Users.
3. In the Search field enter the name of the user to be made a Global Administrator.
4. To create a new Global Administrator:
5. Select the user’s name.
6. A window will appear to the right.
7. Select Manage roles.
8. Select Admin center access.
9. Check Global Administrator.
10. Click Save changes.

To remove Global Admins:

1. Select User.
2. Under Roles select Manage roles.
3. De-Select the appropriate role.
4. Click Save changes.

Note: When tallying the number of Global Administrators, Partner relationships (Settings > Partner Relationships) are not accounted for and should be reviewed on a recurring basis.

Related links

• Microsoft 365 Admin Center
• Get-MgDirectoryRole
• All roles
• 5. Limit the number of Global Administrators to less than 5
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 28

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.1.1.3
Severity	High
Suite	CIS
Product	Microsoft 365
Related products	Entra ID
Feature	Administrative accounts
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.1.3
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:1.1.3, nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCisGlobalAdminCount
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.1.1.3.ps1
• Documentation: tests/cis/Test.CIS.M365.1.1.3.md