Keep between two and four Global Administrators

Description

The tenant counts at least {{ ga_min }} and at most {{ ga_max }} principals with the Global Administrator role. The count includes active and eligible assignments (Privileged Identity Management), members of groups assigned to the role, and the emergency access accounts (CB-M365-ADMIN-002).

Service principals holding Global Administrator count too, and are a strong finding on their own.

Rationale

Global Administrator is the only role with full control over every service and every other role. Each additional holder is one more account an attacker can phish or take over to own the tenant. Keeping at least two avoids losing control of the tenant when one account is unavailable. Day-to-day tasks use narrower roles (CB-M365-ADMIN-004).

Impact

In large tenants the cap forces a review of who really needs the role and a move to finer roles. With the two emergency access accounts counted, only two named administrators remain under the default cap: make them eligible through PIM rather than active.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Roles & admins > Roles & admins > Global Administrator > Assignments. Count the Eligible assignments and Active assignments; for each group, open it and count its members.
3. Read-only PowerShell alternative (Microsoft Graph, scope RoleManagement.Read.Directory):

   $ga = '62e90394-69f5-4237-9190-012177145e10'
   $active   = Get-MgRoleManagementDirectoryRoleAssignment -All -Filter "roleDefinitionId eq '$ga'"
   $eligible = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -Filter "roleDefinitionId eq '$ga'"
   ($active.PrincipalId + $eligible.PrincipalId | Sort-Object -Unique).Count
   

   Expand group principals with Get-MgGroupTransitiveMember.
4. Fail if the number of distinct principals is below {{ ga_min }} or above {{ ga_max }}.

Remediation

1. If there are too few: assign the role to a second named cloud-only administrator (CB-M365-ADMIN-001), preferably as eligible in PIM, with a Privileged Role Administrator.
2. If there are too many: for each holder, identify the tasks really performed (audit logs, role usage in PIM) and assign the matching narrower roles (Exchange Administrator, User Administrator, Security Administrator...).
3. Remove the Global Administrator assignment from those holders in Roles & admins or in ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments.

Rollback

Reassign the role with a Privileged Role Administrator or an emergency access account.

References

• Best practices for Microsoft Entra roles Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Entra built-in roles, privileged roles and permissions Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-ADMIN-004 Assign least-privileged roles instead of Global Administrator
• related CB-M365-ADMIN-018 Keep Global Administrator elevated access to Azure resources turned off

People and lifecycle