(L1) Ensure administrative accounts use licenses with a reduced application footprint

Contributed by Ben MilesAll contributors →

Part of CIS · Microsoft 365 · Administrative accounts · All checks

Run this check

Invoke-Maester -TestId CIS.M365.1.1.4

Overview

1.1.4 (L1) Ensure administrative accounts use licenses with a reduced application footprint

Active administrative accounts should be unlicensed or use licenses that do not provide access to user-facing applications. By default, this check accepts Microsoft Entra ID P1 (AAD_PREMIUM) and P2 (AAD_PREMIUM_P2). Other license SKU part numbers are reported unless they are added to the AllowedLicenseSkuPartNumbers parameter after confirming that they do not enable applications such as email, Teams, or SharePoint.

The check evaluates permanent assignments to roles whose names contain Administrator and the Global Reader role. Eligible assignments managed through Privileged Identity Management are not evaluated. Members of role-assigned groups are evaluated, and the check reports an error if a group’s members cannot be read. It reads assigned license SKU IDs in the batched user request and maps them through the tenant’s subscribed SKU list.

Reducing the application footprint on privileged identities limits their exposure to phishing and malicious content in collaboration services. If administrators need those applications for daily work, use separate non-privileged accounts.

Remediation action

1. In the Microsoft 365 admin center, go to Users > Active users.
2. For each listed account, open Licenses and apps and remove licenses outside the approved identity-only list. If a license is assigned through a group, update the group’s license assignment.
3. Keep only Microsoft Entra ID P1, P2, or another verified identity-only license on the administrative account. If the administrator needs email or collaboration apps, assign those licenses to a separate non-privileged account.
4. Configure eligible administrative roles through Privileged Identity Management and require approval for activation. Route tenant administrator alerts to a monitored security or operations mailbox.

Related links

• Assign licenses to users in the Microsoft 365 admin center
• Microsoft Entra ID licenses
• CIS Microsoft 365 Foundations Benchmark v7.0.0

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.1.1.4
Severity	Medium
Suite	CIS
Product	Microsoft 365
Related products	Entra ID
Feature	Administrative accounts
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.1.4
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:1.1.4, nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCisAdminLicenseFootprint
Services	Graph
Permissions	Graph:Scope:RoleManagement.Read.Directory | Graph:Scope:RoleManagement.Read.All, Graph:Scope:Directory.Read.All

Source

• Test: tests/cis/Test.CIS.M365.1.1.4.ps1
• Documentation: tests/cis/Test.CIS.M365.1.1.4.md