Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Privileged Identity Management · All checks

Run this check

Invoke-Maester -TestId DISA.V-270255 -IncludePreview

Overview

Every Microsoft Entra role with an active or eligible assignment sends its Privileged Identity Management activation alert to the system administrators and the information system security officer (DISA Microsoft Entra ID STIG, V-270255, CAT II).

When an eligible user activates a role, Privileged Identity Management can email an alert. Sending it to the people who watch the system (DISA names the SA and the ISSO) means an unexpected activation, such as one made with stolen credentials, is seen while the elevation is still active. DISA asks for this on every role that has an assignment, not only the most privileged ones.

The check lists the roles that have an active or eligible assignment and reads the Additional recipients of each role’s Role activation alert. A role fails when that list is empty. Set RequiredRecipient to the SA and ISSO addresses to require those exact recipients. CISA.MS.AAD.7.8 and CISA.MS.AAD.7.9 read the same alert for the highly privileged roles only.

Remediation action

1. In the Microsoft Entra admin center, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Settings.
2. For each role this test lists, select the role and Edit.
3. On the Notification tab, under Send notifications when eligible members activate this role, add the SA and ISSO addresses as Additional recipients of the Role activation alert.
4. Select Update.

Related links

• DISA Microsoft Entra ID STIG: V-270255
• Configure Microsoft Entra role settings in Privileged Identity Management

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270255
Severity	Medium
Suite	DISA
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1548.005 Temporary Elevated Cloud Access
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270255
Supports controls	disa-stig-entra-id:V-270255, nist-800-53-r5:AC-2(1)
PowerShell test	Test-MtDisaRoleActivationNotification
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance
Lifecycle	Preview

Source

• Test: tests/disa/Test.DISA.V-270255.ps1
• Documentation: tests/disa/Test.DISA.V-270255.md