Privileged roles aren't assigned to stale identities

Maester checks this too

MT.1029 (Stale accounts are not assigned to privileged roles.) checks the same setting. Running both reports it twice.

Overview

Privileged roles should not remain assigned to identities that show no recent sign-in activity. Stale accounts with administrative privileges are attractive targets for attackers because they can be compromised without triggering behavioral analytics alerts. Regularly reviewing and removing privileged role assignments from inactive identities reduces the risk of credential-based attacks and helps maintain least-privilege access.

Remediation

• Review privileged role assignments using access reviews
• Remove privileged role assignments from inactive identities
• Configure automated access reviews for privileged roles

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
ATT&CK	T1078.004 Cloud Accounts
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.