Activation of the Global Administrator role SHALL require approval
CISA.MS.AAD.7.6MediumEntra IDPrivileged Identity Management
Part of CISA · Entra ID · Privileged Identity Management · All checks
Invoke-Maester -TestId CISA.MS.AAD.7.6Overview
Section titled “Overview”Activation of the Global Administrator role SHALL require approval.
Rationale: Requiring approval for a user to activate Global Administrator, which provides unfettered access, makes it more challenging for an attacker to compromise the tenant with stolen credentials and it provides visibility of activities indicating a compromise is taking place.
Remediation action:
Section titled “Remediation action:”- In Entra admin center select Identity governance and Privileged Identity Management.
- Under Manage, select Microsoft Entra roles.
- Under Manage, select Roles.
- Select the Global Administrator role in the list.
- Click Settings.
- Click Edit.
- Select the Require approval to activate option.
- Click Update.
- Review the list of groups that are actively assigned to the Global Administrator role. If any of the groups are enrolled in PIM for Groups, then also apply the same configurations under step 2 above to each PIM group’s Member settings.
Related links
Section titled “Related links”- Entra admin center - Privileged Identity Management | Microsoft Entra roles
- CISA 7.6 Highly Privileged User Access - MS.AAD.7.6v1
- CISA ScubaGear Rego Reference
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.7.6 |
| Severity | Medium |
| Suite | CISA |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles, T1548.005 Temporary Elevated Cloud Access |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.6 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.7.6v1 |
| Supports controls | cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1) |
| PowerShell test | Test-MtCisaRequireActivationApproval |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
Section titled “Source”- Test:
tests/cisa/entra/Test.CISA.MS.AAD.7.6.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.7.6.md