Activation alert for Global Administrator role assignments

Maester checks this too

CISA.MS.AAD.7.8 (User activation of the Global Administrator role SHALL trigger an alert.) checks the same setting. Running both reports it twice.

Overview

Without activation alerts for Global Administrator role assignments, threat actors can escalate privileges undetected. This lack of visibility creates a blind spot where attackers can activate the most privileged role and perform malicious actions such as creating backdoor accounts, modifying security policies, or accessing sensitive data.

Monitoring these activation alerts can help security teams distinguish between authorized and unauthorized privilege escalation activities.

Remediation

• Configure notifications for privileged roles

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Privileged access
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
ATT&CK	T1098.003 Additional Cloud Roles, T1548.005 Temporary Elevated Cloud Access
Licence	P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.