ASD.ISM-1649 - Just-in-time administration is used for the administration of systems and their resources.
Overview
Just-in-time administration is used for the administration of systems and their resources (ISM-1649, Essential Eight Maturity Level Three).
A standing administrator role is a target around the clock: whoever holds the account holds the tenant. With Privileged Identity Management, administrators are eligible for a role and activate it for a few hours when they need it, with MFA, a justification and an audit trail.
ASD's assessment guide describes just-in-time administration as granting privileged users access "immediately before that access is required and for only as long as it is required", and the ASD Blueprint for Secure Cloud makes every Microsoft Entra role an eligible assignment, with permanent active assignments only for break glass accounts. This test runs the same check as CIS.M365.5.3.1: every active assignment of a user or group to a role that Microsoft Entra marks as privileged must have been made by an activation. A time-bound active assignment fails as well, because it is standing access for its whole duration. A service principal passes when its assignment has an end date. Permanent Global Administrator assignments are allowed only for the emergency access accounts named in the Maester configuration (EmergencyAccessAccounts), up to two. See Emergency access accounts.
Remediation action
- In the Microsoft Entra admin center, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments.
- For each Active assignment listed below, choose Remove, then add the user or group again under Eligible assignments.
- In Settings for each role, require multifactor authentication on activation, set a maximum activation duration and require a justification.
- Keep your emergency access accounts permanently assigned, and list them in
maester-config.jsonso Maester leaves them out.
Related links
- Essential Eight maturity model
- Essential Eight assessment process guide
- ASD Blueprint for Secure Cloud: Roles
- Assign Microsoft Entra roles in Privileged Identity Management
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1649 |
| Severity | High |
| Suite | ASD |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1649 |
| Benchmark level | ML3 |
| Essential Eight strategy | Restrict administrative privileges |
| Supports controls | essential-eight:ISM-1649, nist-800-53-r5:AC-2(7), nist-800-53-r5:AC-6(5), ism:ISM-1649 |
| PowerShell test | Test-MtAsdJustInTimeAdministration |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1649.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1649.md