# Microsoft Entra ID must use Privileged Identity Management (PIM)

No privileged Microsoft Entra role has an active assignment that never ends. (DISA Microsoft Entra ID STIG, V-270335, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-270335

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Privileged Identity Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270335
```

## Overview

No privileged Microsoft Entra role has an active assignment that never ends. (DISA Microsoft Entra ID STIG, V-270335, CAT II).

A permanent active assignment keeps admin rights on an account around the clock, so a stolen session or password gives them straight away. With Privileged Identity Management, users hold the role only when they activate it, for a limited time.

DISA's check looks at the active assignments of each privileged role and is a finding when one ends **Permanent**. This test runs [CISA.MS.AAD.7.4](https://maester.dev/docs/tests/CISA.MS.AAD.7.4), which checks the roles that CISA counts as highly privileged. Review the other privileged roles in your tenant by hand.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **ID Governance** > **Privileged Identity Management** > **[Microsoft Entra roles](https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles)** > **Assignments**.
2. On the **Active assignments** tab, find the assignments whose end time is **Permanent**.
3. Change each one to an eligible assignment, leaving permanent active assignments only on your emergency access accounts.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270335](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270335)
* [Start using Privileged Identity Management](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-getting-started)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270335 |
| Severity | High |
| Suite | DISA |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270335 |
| Supports controls | disa-stig-entra-id:V-270335, nist-800-53-r5:AC-2(2) |
| PowerShell test | [Test-MtDisaEntraNoPermanentPrivilegedAssignment](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270335.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270335.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270335.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270335.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270335.md)