# (L1) Ensure approval is required for Global Administrator role activation

Activating the Global Administrator role in Privileged Identity Management needs approval from at least one other person.

Source: https://maester.dev/docs/tests/CIS.M365.5.3.4

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Privileged Identity Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.3.4
```

## Overview

Activating the Global Administrator role in Privileged Identity Management needs approval from at least one other person.

Global Administrator can change anything in the tenant. If an attacker gets an eligible account, MFA is the only barrier to activating the role. Requiring approval adds a second person who can refuse an activation that looks wrong, and creates a record of why it was granted. Without approval, an attacker with an eligible account can take temporary elevated access silently.

Approval slows urgent changes, so define more than one approver and agree how to handle out-of-hours requests. Microsoft Entra ID P2 or Microsoft Entra ID Governance licences are required.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to [Privileged Identity Management](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles) > **Microsoft Entra roles** > **Roles** and select **Global Administrator**.
3. Select **Role settings** > **Edit**.
4. On the **Activation** tab, select **Require approval to activate** and **Select approvers**. Add at least one user or group.
5. Select **Update**.

#### Related links

* [Microsoft Entra admin center - Privileged Identity Management](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)
* [Approve or deny requests for Microsoft Entra roles in PIM](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-approval-workflow)
* [Configure Microsoft Entra role settings in PIM](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.4](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.3.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1548.005 Temporary Elevated Cloud Access |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.4 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.4, nist-800-53-r5:AC-5 |
| PowerShell test | [Test-MtCisGlobalAdminActivationApproval](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.4.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.3.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.4.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.3.4.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.4.md)