A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role

Contributed by Michael Soule with 3 co-contributorsAll contributors →

Part of CISA · Entra ID · Roles and administrators · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.7.1

Overview

A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.

Rationale: The Global Administrator role provides unfettered access to the tenant (Azure and Microsoft 365). Limiting the number of users with this level of access makes tenant compromise more challenging. Microsoft recommends fewer than five users in the Global Administrator role. However, additional user accounts, up to eight, may be necessary to support emergency access and some operational scenarios.

Remediation action:

When counting the number of users assigned to the Global Administrator role, count each user only once.

1. In Entra under Roles & adminis and All roles, search for Global Administrator and click on it to go to the role and see who is assiged. Count users that are assigned directly to the role and users assigned via group membership.

   If you have Entra ID PIM, count both the Eligible assignments and Active assignments.

   If any of the groups assigned to Global Administrator are enrolled in PIM for Groups, also count the number of group members from the PIM for Groups portal Eligible assignments.

2. Validate that there are a total of two to eight users assigned to the Global Administrator role.

Related links

• Entra admin center - Roles and administrators | All roles
• CISA 7.1 Highly Privileged User Access - MS.AAD.7.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.7.1
Severity	High
Suite	CISA
Product	Entra ID
Feature	Roles and administrators
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.1
Criticality	SHALL
Upstream requirement	MS.AAD.7.1v1
Supports controls	cisa-scuba:MS.AAD.7.1, nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCisaGlobalAdminCount
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.7.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.7.1.md