Global Administrators don't have standing access to Azure subscriptions

Overview

Global Administrators with persistent access to Azure subscriptions expand the attack surface for threat actors. If a Global Administrator account is compromised, attackers can immediately enumerate resources, modify configurations, assign roles, and exfiltrate sensitive data across all subscriptions. Requiring just-in-time elevation for subscription access introduces detectable signals, slows attacker velocity, and routes high-impact operations through observable control points.

Remediation

• Get started with a phishing-resistant passwordless authentication deployment

• Ensure that privileged accounts register and use phishing resistant methods

• Deploy Conditional Access policy to target privileged accounts and require phishing resistant credentials using authentication strengths

• Monitor authentication method activity

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Privileged access
Product	Azure
Feature	Access management
Area	Privileged access
ATT&CK	T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles
Licence	Free
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.