Administrative privileges are tightly limited to prevent compromise

Overview

Excessive assignment of roles like Global Administrator and Global Secure Access Administrator create a path for threat actors to compromise these identities. With these roles an attacker can authenticate, manipulate security policies, create or elevate accounts, disable monitoring, access all corporate data, and more. Limit access to these roles to a small set of administrators, and enable monitoring of assignments and activation for groups, guests, service principals, and disabled accounts to reduce the attack surface and enforce least privilege.

Remediation

• Emergency access accounts are configured appropriately
• Limit Global Administrator and Global Secure Access Administrator role assignments to a small set of administrators.
• Configure role settings to require approval for Global Administrator activation

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Roles and administrators
Area	Privileged access
ATT&CK	T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles
Licence	AAD_PREMIUM, AAD_PREMIUM_P2
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.