{
  "id": "CB-M365-ADMIN-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-003",
    "title": "Keep between two and four Global Administrators",
    "finding": {
      "title": "The number of Global Administrators is outside the allowed range",
      "description": "Too many Global Administrators multiply the accounts that can take over the tenant; a single one is a single point of failure."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "global-admin",
      "least-privilege"
    ],
    "parameters": [
      {
        "name": "ga_min",
        "type": "integer",
        "description": "Minimum number of Global Administrators.",
        "default": 2,
        "minimum": 2
      },
      {
        "name": "ga_max",
        "type": "integer",
        "description": "Maximum number of Global Administrators. Raise it only for very large tenants, with a written justification.",
        "default": 4,
        "minimum": 2
      }
    ],
    "description": "The tenant counts at least `{{ ga_min }}` and at most `{{ ga_max }}` principals with the Global\nAdministrator role. The count includes active and eligible assignments (Privileged Identity\nManagement), members of groups assigned to the role, and the emergency access accounts\n(CB-M365-ADMIN-002).\n",
    "rationale": "Global Administrator is the only role with full control over every service and every other\nrole. Each additional holder is one more account an attacker can phish or take over to own the\ntenant. Keeping at least two avoids losing control of the tenant when one account is unavailable.\nDay-to-day tasks use narrower roles (CB-M365-ADMIN-004).\n",
    "impact": "In large tenants the cap forces a review of who really needs the role and a move to finer\nroles. With the two emergency access accounts counted, only two named administrators remain\nunder the default cap: make them eligible through PIM rather than active.\n",
    "notes": "Service principals holding Global Administrator count too, and are a strong finding on their\nown.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Roles & admins** > **Roles & admins** > **Global\n   Administrator** > **Assignments**. Count the **Eligible assignments** and **Active\n   assignments**; for each group, open it and count its members.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `RoleManagement.Read.Directory`):\n   ```\n   $ga = '62e90394-69f5-4237-9190-012177145e10'\n   $active   = Get-MgRoleManagementDirectoryRoleAssignment -All -Filter \"roleDefinitionId eq '$ga'\"\n   $eligible = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -Filter \"roleDefinitionId eq '$ga'\"\n   ($active.PrincipalId + $eligible.PrincipalId | Sort-Object -Unique).Count\n   ```\n   Expand group principals with `Get-MgGroupTransitiveMember`.\n4. Fail if the number of distinct principals is below `{{ ga_min }}` or above `{{ ga_max }}`.\n"
    },
    "remediation": {
      "manual": "1. If there are too few: assign the role to a second named cloud-only administrator\n   (CB-M365-ADMIN-001), preferably as eligible in PIM, with a Privileged Role Administrator.\n2. If there are too many: for each holder, identify the tasks really performed (audit logs,\n   role usage in PIM) and assign the matching narrower roles (Exchange Administrator, User\n   Administrator, Security Administrator...).\n3. Remove the Global Administrator assignment from those holders in **Roles & admins** or\n   in **ID Governance** > **Privileged Identity Management** > **Microsoft Entra roles** >\n   **Assignments**.\n",
      "rollback": "Reassign the role with a Privileged Role Administrator or an emergency access account.\n"
    },
    "references": [
      {
        "title": "Best practices for Microsoft Entra roles",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft Entra built-in roles, privileged roles and permissions",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/privileged-roles-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.1v1",
        "relation": "stricter",
        "note": "SCuBA allows up to eight Global Administrators; ours caps at four by default."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-004",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-018",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}