{
  "id": "CB-M365-ADMIN-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-001",
    "title": "Use dedicated, named, cloud-only accounts for administrative roles",
    "finding": {
      "title": "Privileged roles are held by synchronized, shared or everyday accounts",
      "description": "A compromise of the on-premises directory, of a shared password or of a user's mailbox gives the attacker the privileged role along with the account."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "admin-accounts",
      "cloud-only",
      "hybrid-identity",
      "least-privilege"
    ],
    "description": "Every account that holds a privileged Microsoft Entra role (active or eligible, directly or\nthrough a group) is:\n\n- **cloud-only**: created in Microsoft Entra ID, not synchronized from Active Directory and not\n  federated with another identity provider (`onPremisesSyncEnabled` is empty or `false`);\n- **dedicated**: used only for administration, separate from the person's everyday account that\n  reads mail, browses and works on documents;\n- **named**: assigned to one identified person, never shared between several administrators.\n\nThe emergency access accounts (CB-M365-ADMIN-002) are the only non-named exception.\n",
    "rationale": "A synchronized account inherits the trust of Active Directory: whoever controls a domain\ncontroller or the Entra Connect server can reset its password or take it over, and pivot from\nthe on-premises network to the whole tenant. A federated account depends on the security of the\nexternal identity provider. An everyday account is exposed to phishing, malicious attachments and\nbrowser exploits all day long; separating the admin account keeps those threats away from the\nprivileges. Named accounts make every privileged action traceable to a person.\n",
    "impact": "Each administrator manages a second account and a second set of authentication methods. Scripts\nor service desks that rely on synchronized admin accounts must be moved to the cloud-only ones.\nAdministrators whose on-premises role required the same account keep a separate account in\nActive Directory.\n",
    "notes": "Naming conventions (for example an `adm-` prefix) help reviewers, but only the account owner\nregistry proves that an account is named and dedicated. The license footprint of admin accounts\nis covered by CB-M365-ADMIN-005.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Roles & admins** > **Roles & admins**. For each role marked\n   **Privileged**, open **Assignments** and list the active and eligible members; expand\n   groups.\n3. For each account, open the user and check **Properties** > **On-premises** >\n   **On-premises sync enabled**: it must be **No** (or empty).\n4. Check against the administrator registry that each account belongs to one person and is\n   not that person's everyday account (no mailbox use, no Teams activity, see\n   CB-M365-ADMIN-005).\n5. Read-only PowerShell alternative (Microsoft Graph, scope `RoleManagement.Read.Directory`,\n   `User.Read.All`):\n   ```\n   Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty Principal |\n     ForEach-Object { Get-MgUser -UserId $_.PrincipalId -Property UserPrincipalName,OnPremisesSyncEnabled -ErrorAction SilentlyContinue } |\n     Where-Object OnPremisesSyncEnabled | Select-Object UserPrincipalName\n   ```\n   Repeat with `Get-MgRoleManagementDirectoryRoleEligibilitySchedule` for eligible\n   assignments.\n6. Fail if any privileged role holder is synchronized from on-premises, is shared, or is the\n   everyday account of its owner.\n"
    },
    "remediation": {
      "manual": "1. For each administrator in breach, create a cloud-only account (user principal name on a\n   managed domain or on `*.onmicrosoft.com`) with at least the User Administrator role\n   (Privileged Authentication Administrator is needed to reset methods of other admins).\n2. Have the owner register phishing-resistant methods on the new account\n   (CB-M365-AUTH-004).\n3. Assign the roles to the new account, preferably as eligible through Privileged Identity\n   Management (CB-M365-ADMIN-006), with at least the Privileged Role Administrator role.\n4. Remove the roles from the synchronized, shared or everyday account.\n5. Replace any shared admin account with named accounts, then disable and delete it.\n",
      "rollback": "Reassign the roles to the previous account from **Roles & admins** with a Privileged Role\nAdministrator or an emergency access account.\n"
    },
    "references": [
      {
        "title": "Best practices for Microsoft Entra roles",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-planning",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.3v1",
        "relation": "stricter",
        "note": "SCuBA only asks for cloud-only accounts; ours also requires dedicated and named accounts."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R27",
        "relation": "equivalent"
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R28",
        "relation": "partial",
        "note": "Cloud-only accounts keep admin identities out of the on-premises directory; access to the Entra directory itself is covered by other controls."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R30",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(2)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-005",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-012",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-045",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}