ASD.ISM-1648 - Privileged access to systems and their resources is disabled after 45 days of inactivity.
Overview
Privileged access to systems and their resources is disabled after 45 days of inactivity (ISM-1648, Essential Eight Maturity Level Two).
An administrator account nobody uses is an account nobody watches. Its password ages, its owner may have moved on, and a sign-in on it is unlikely to be questioned. This check lists the users with an active or eligible assignment to a directory role that Microsoft Entra marks as privileged, directly or through a role-assignable group, and reads the last sign-in of each. An enabled account fails when its most recent interactive or non-interactive sign-in is older than 45 days (the InactiveDays parameter), or when it has never signed in and was created before that. Emergency access accounts named in the Maester configuration (EmergencyAccessAccounts) are left out, because they are meant to stay unused.
MT.1029 reports the same accounts through the Privileged Identity Management alert for stale accounts, whose number of days each tenant sets. ASD names 45 days, so this check reads the sign-ins itself. ASD's own assessment script leaves out accounts that have never signed in; this check counts them, because an administrator account created more than 45 days ago and never used is just as inactive.
Remediation action
- In Microsoft Entra admin center, open Users and check each account listed below with its owner.
- Remove the privileged role in Roles & administrators, or disable the account under Edit properties > Account enabled.
- Turn on the Stale sign-ins alert in Privileged Identity Management > Alerts > Settings, and configure an access review of the privileged roles so inactive access is removed before this check fails again.
Related links
- Essential Eight maturity model
- Security alerts for Microsoft Entra roles in PIM
- How to manage inactive user accounts
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1648 |
| Severity | Medium |
| Suite | ASD |
| Product | Entra ID |
| Feature | Roles and administrators |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1648 |
| Benchmark level | ML2 |
| Essential Eight strategy | Restrict administrative privileges |
| Supports controls | essential-eight:ISM-1648, nist-800-53-r5:AC-2(3), ism:ISM-1648 |
| PowerShell test | Test-MtAsdInactivePrivilegedAccess |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1648.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1648.md