CIS.M365.5.3.1 - (L2) Ensure privileged role assignments are activated and not assigned
Overview
Privileged directory roles are held through Privileged Identity Management (PIM) activation instead of permanent active assignment.
An account with a permanent privileged role is a permanent target: a stolen password or token gives immediate administrative access, at any hour, with no approval, justification or time limit. Making the role eligible means the account is an ordinary user until an admin activates the role for a few hours, with MFA and an audit trail. An attacker who adds a role to an account to keep access leaves a permanent assignment, and this test lists it.
The test lists every active assignment to a privileged role. Users and groups pass when the assignment type is Activated. Service principals pass when the assignment has an end date. Permanent Global Administrator assignments are accepted only for accounts listed in the EmergencyAccessAccounts setting of maester-config.json, up to two. When the setting is empty, every permanent assignment fails. See Emergency access accounts for how to configure it. Microsoft Entra ID P2 or Microsoft Entra ID Governance licences are required.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Roles & admins, or open Privileged Identity Management and select Microsoft Entra roles.
- Open Assignments > Active assignments and select each permanent assignment of a privileged role.
- Select Update and change the assignment to Eligible, then save.
- Ask the administrators to activate their role when they need it. Keep two cloud-only emergency access accounts as the only permanent Global Administrators, and list them in the EmergencyAccessAccounts setting of maester-config.json.
Related links
- Microsoft Entra admin center - Privileged Identity Management
- Assign Microsoft Entra roles in Privileged Identity Management
- Best practices for Microsoft Entra roles
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.3.1 |
| Severity | High |
| Suite | CIS |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.1 |
| Benchmark level | L2 |
| Benchmark profiles | E5 Level 2 |
| Supports controls | cis-m365:5.3.1, nist-800-53-r5:AC-6(5) |
| PowerShell test | Test-MtCisPrivilegedRolesActivatedNotAssigned |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/cis/Test.CIS.M365.5.3.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.3.1.md