(L1) Ensure approval is required for Global Administrator role activation
Part of CIS · Entra ID · Privileged Identity Management · All checks
Invoke-Maester -TestId CIS.M365.5.3.4Overview
Section titled “Overview”Activating the Global Administrator role in Privileged Identity Management needs approval from at least one other person.
Global Administrator can change anything in the tenant. If an attacker gets an eligible account, MFA is the only barrier to activating the role. Requiring approval adds a second person who can refuse an activation that looks wrong, and creates a record of why it was granted. Without approval, an attacker with an eligible account can take temporary elevated access silently.
Approval slows urgent changes, so define more than one approver and agree how to handle out-of-hours requests. Microsoft Entra ID P2 or Microsoft Entra ID Governance licences are required.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center.
- Go to Privileged Identity Management > Microsoft Entra roles > Roles and select Global Administrator.
- Select Role settings > Edit.
- On the Activation tab, select Require approval to activate and Select approvers. Add at least one user or group.
- Select Update.
Related links
Section titled “Related links”- Microsoft Entra admin center - Privileged Identity Management
- Approve or deny requests for Microsoft Entra roles in PIM
- Configure Microsoft Entra role settings in PIM
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.4
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.3.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1548.005 Temporary Elevated Cloud Access |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.4 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.4, nist-800-53-r5:AC-5 |
| PowerShell test | Test-MtCisGlobalAdminActivationApproval |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.5.3.4.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.3.4.md