# Privileged roles aren't assigned to stale identities
Privileged roles should not remain assigned to identities that show no recent sign-in activity.
Source: https://maester.dev/docs/tests/ZTA.21854
:::note[Maester checks this too]
[MT.1029](/docs/tests/MT.1029) (Stale accounts are not assigned to privileged roles.) checks the same setting. Running both reports it twice.
:::
## Overview
Privileged roles should not remain assigned to identities that show no recent sign-in activity. Stale accounts with administrative privileges are attractive targets for attackers because they can be compromised without triggering behavioral analytics alerts. Regularly reviewing and removing privileged role assignments from inactive identities reduces the risk of credential-based attacks and helps maintain least-privilege access.
## Remediation
- [Review privileged role assignments using access reviews](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Remove privileged role assignments from inactive identities](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-resource-roles-assign-roles?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#update-or-remove-an-existing-role-assignment)
- [Configure automated access reviews for privileged roles](https://learn.microsoft.com/entra/id-governance/access-reviews-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.