# Eligible and Active highly privileged role assignments SHALL trigger an alert Eligible and Active highly privileged role assignments SHALL trigger an alert. Source: https://maester.dev/docs/tests/CISA.MS.AAD.7.7
Michael SouleMichael Morten SonneJean-Philippe George
Contributed by Michael Soule with 2 co-contributorsAll contributors →

Part of CISA · Entra ID · Privileged Identity Management · All checks

```powershell title="Run this check" Invoke-Maester -TestId CISA.MS.AAD.7.7 ``` ## Overview Eligible and Active highly privileged role assignments SHALL trigger an alert. Rationale: Closely monitor assignment of the highest privileged roles for signs of compromise. Send assignment alerts to enable the security monitoring team to detect compromise attempts. #### Remediation action: 1. In **Entra admin center** select **Identity governance** and **Privileged Identity Management**. 2. Under **Manage**, select **Microsoft Entra roles**. 3. Under **Manage**, select **[Roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)**. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example. 4. Click the **Global Administrator** role. 5. Click **Settings** and then click **Edit**. 6. Click the **Notifications** tab. 7. Under **Send notifications when members are assigned as eligible to this role**, in the **Role assignment alert** > **Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts. 8. Under **Send notifications when members are assigned as active to this role**, in the **Role assignment alert** > **Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts. 9. Click **Update**. 10. For each of the highly privileged roles, if they have any PIM groups actively assigned to them, then also apply the same configurations per the steps above to each PIM group's **Member** settings. #### Related links * [Entra admin center - Privileged Identity Management | Microsoft Entra roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles) * [CISA 7.7 Highly Privileged User Access - MS.AAD.7.7v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md#msaad77v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/AADConfig.rego#L974) ## Details
Every attribute of this check | Field | Value | | --- | --- | | Test ID | CISA.MS.AAD.7.7 | | Severity | Medium | | Suite | CISA | | Product | Entra ID | | Feature | Privileged Identity Management | | Area | Privileged access | | Resource type | DirectoryRole | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1098.003 Additional Cloud Roles | | Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.7 | | Criticality | SHALL | | Upstream requirement | MS.AAD.7.7v1 | | Supports controls | cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1) | | PowerShell test | [Test-MtCisaAssignmentNotification](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.7.7.ps1) | | Services | Graph | | Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
## Source - Test: [`tests/cisa/entra/Test.CISA.MS.AAD.7.7.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.7.7.ps1) - Documentation: [`tests/cisa/entra/Test.CISA.MS.AAD.7.7.md`](https://github.com/maester365/maester/blob/main/tests/cisa/entra/Test.CISA.MS.AAD.7.7.md)