Assign least-privileged roles instead of Global Administrator

Description

Administrative tasks are delegated with the narrowest built-in or custom role that covers them (Exchange Administrator, SharePoint Administrator, User Administrator, Helpdesk Administrator, Security Operator...), scoped to an administrative unit where possible. Global Administrator is kept for the few tasks only it can perform.

Measurable target: Global Administrator holders are fewer than half of all principals holding a privileged role (active or eligible).

The ratio is a signal, not a goal: a tenant with two Global Administrators and two other admins passes, but role design still deserves a review.

Rationale

Most daily administration needs a fraction of Global Administrator's permissions. Narrow roles limit what a stolen admin session can do and make the audit trail easier to read. A tenant where most privileged users are Global Administrators has in practice no role separation.

Impact

Administrators may need several roles, or a custom role (Microsoft Entra ID P1) for a precise set of permissions. Some admin center pages require a specific role; test each delegation with the person who will use it.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Roles & admins > Roles & admins, filter on Privileged roles and note the active and eligible holders of each, expanding groups.
3. Count the distinct principals holding Global Administrator (G) and the distinct principals holding any privileged role (P).
4. Read-only PowerShell alternative (Microsoft Graph, scope RoleManagement.Read.Directory):

   $priv = Get-MgRoleManagementDirectoryRoleDefinition -All | Where-Object IsPrivileged
   $all  = Get-MgRoleManagementDirectoryRoleAssignment -All | Where-Object RoleDefinitionId -in $priv.Id
   

   Add eligible assignments with Get-MgRoleManagementDirectoryRoleEligibilitySchedule.
5. Fail if G is half of P or more, or if a Global Administrator's activity (audit logs) only concerns one service.

Remediation

1. For each Global Administrator, list the tasks performed over the last 90 days in Entra ID > Monitoring & health > Audit logs and the admin centers used.
2. Map those tasks to built-in roles (see the least-privileged roles by task page) or create a custom role.
3. Assign the narrower roles, eligible through PIM where licensed, with a Privileged Role Administrator.
4. Remove the Global Administrator assignment once the person confirms the new roles work.

Rollback

Reassign Global Administrator temporarily through PIM while the role design is fixed.

References

• Least privileged roles by task in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• Best practices for Microsoft Entra roles Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-ADMIN-003 Keep between two and four Global Administrators
• related CB-M365-DEVICE-005 Do not add Global Administrators as local administrators at Entra join

People and lifecycle