All privileged role assignments are managed with PIM

Maester checks this too

CISA.MS.AAD.7.5 (Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.) checks the same setting. Running both reports it twice.

Overview

Threat actors who compromise permanently assigned privileged accounts gain continuous access to high-impact directory operations. This extended access allows attackers to establish persistent backdoors, modify security configurations, and disable monitoring systems. Without time-limited access controls, compromised privileged accounts provide indefinite tenant control.

Requiring eligible role assignments to be activated just-in-time, reduces the attack surface and limits attacker dwell time.

Remediation

• Use Privileged Identity Management to manage privileged Microsoft Entra roles

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Privileged access
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
ATT&CK	T1098.003 Additional Cloud Roles
Licence	P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.