ASD.ISM-1175 - Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.
Overview
Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services (ISM-1175, Essential Eight Maturity Level One). This also supports ISM-0445: privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.
When the same account reads email, browses the web and administers the tenant, every phishing message and every malicious link reaches an administrator. A separate, unlicensed account for privileged duties keeps the role away from the inbox. ASD's assessment guide tests the email part of this control by listing the privileged accounts that have an email address.
This check lists the users with an active or eligible assignment to a directory role that Microsoft Entra marks as privileged, directly or through a role-assignable group, and fails for each one that has an enabled Exchange Online service plan that provides a mailbox (Plan 1, Plan 2, Kiosk or Essentials; the MailboxServicePlanId parameter). The Exchange Foundation plan that comes with Entra ID, Intune and Defender licences creates no mailbox and does not count. Emergency access accounts named in the Maester configuration (EmergencyAccessAccounts) are left out. Blocking the internet and web services for these accounts is done on the device and is not read by this check.
MT.1028 looks for mailboxes on permanent Control Plane assignments only. ASD's test covers every privileged account, eligible ones included, so this check reads them itself.
Remediation action
- For each administrator listed below, create a cloud-only account for privileged work, for example
[email protected], and do not assign it a licence that includes Exchange Online. - In Microsoft Entra admin center, open Roles & administrators (or Privileged Identity Management) and move the role from the everyday account to the new one.
- Where an administrator must receive mail for a role, forward it to the everyday account rather than keeping a mailbox on the privileged one.
Related links
- Essential Eight maturity model
- Essential Eight assessment process guide
- ISM Guidelines for system access: Privileged access to systems
- Securing privileged access: separate user accounts for administrators
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1175 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Roles and administrators |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1566 Phishing |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1175 |
| Benchmark level | ML1 |
| Essential Eight strategy | Restrict administrative privileges |
| Supports controls | essential-eight:ISM-1175, essential-eight:ISM-0445, nist-800-53-r5:AC-6(2), nist-800-53-r5:AC-6(5), ism:ISM-1175, ism:ISM-0445 |
| PowerShell test | Test-MtAsdPrivilegedUserMailbox |
| Services | Graph |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1175.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1175.md