CIS.M365.5.3.5 - (L1) Ensure approval is required for Privileged Role Administrator activation
Overview
Activating the Privileged Role Administrator role in Privileged Identity Management needs approval from at least one other person.
Privileged Role Administrator can manage role assignments and PIM settings, which means that it can give itself, or anyone, any other role, and can weaken the approval requirements on other roles. Treating it like Global Administrator closes that route around the approval for other roles.
If an attacker gets an eligible account, MFA is the first barrier to activating the role. Approval adds a second person who can refuse an activation that looks wrong, so it is a layer behind MFA.
Approval slows urgent changes, so define more than one approver and agree how to handle out-of-hours requests. Microsoft Entra ID P2 or Microsoft Entra ID Governance licences are required.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Privileged Identity Management > Microsoft Entra roles > Roles and select Privileged Role Administrator.
- Select Role settings > Edit.
- On the Activation tab, select Require approval to activate and Select approvers. Add at least one user or group.
- Select Update.
Related links
- Microsoft Entra admin center - Privileged Identity Management
- Approve or deny requests for Microsoft Entra roles in PIM
- Configure Microsoft Entra role settings in PIM
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.5
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.3.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.5 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.5, nist-800-53-r5:AC-5 |
| PowerShell test | Test-MtCisPrivilegedRoleAdminActivationApproval |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/cis/Test.CIS.M365.5.3.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.3.5.md