# (L1) Ensure approval is required for Privileged Role Administrator activation

Activating the Privileged Role Administrator role in Privileged Identity Management needs approval from at least one other person.

Source: https://maester.dev/docs/tests/CIS.M365.5.3.5

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Privileged Identity Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.3.5
```

## Overview

Activating the Privileged Role Administrator role in Privileged Identity Management needs approval from at least one other person.

Privileged Role Administrator can manage role assignments and PIM settings, which means that it can give itself, or anyone, any other role, and can weaken the approval requirements on other roles. Treating it like Global Administrator closes that route around the approval for other roles.

If an attacker gets an eligible account, MFA is the first barrier to activating the role. Approval adds a second person who can refuse an activation that looks wrong, so it is a layer behind MFA.

Approval slows urgent changes, so define more than one approver and agree how to handle out-of-hours requests. Microsoft Entra ID P2 or Microsoft Entra ID Governance licences are required.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to [Privileged Identity Management](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles) > **Microsoft Entra roles** > **Roles** and select **Privileged Role Administrator**.
3. Select **Role settings** > **Edit**.
4. On the **Activation** tab, select **Require approval to activate** and **Select approvers**. Add at least one user or group.
5. Select **Update**.

#### Related links

* [Microsoft Entra admin center - Privileged Identity Management](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)
* [Approve or deny requests for Microsoft Entra roles in PIM](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-approval-workflow)
* [Configure Microsoft Entra role settings in PIM](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.5](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.3.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.5 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.5, nist-800-53-r5:AC-5 |
| PowerShell test | [Test-MtCisPrivilegedRoleAdminActivationApproval](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.5.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.3.5.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.5.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.3.5.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.3.5.md)