{
  "id": "CB-M365-ADMIN-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-004.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-004",
    "title": "Assign least-privileged roles instead of Global Administrator",
    "finding": {
      "title": "Global Administrator is used where narrower roles would do",
      "description": "Administrators hold full control of the tenant for tasks that a service-specific role covers, so any of their accounts is a path to full compromise."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "least-privilege",
      "global-admin",
      "rbac"
    ],
    "description": "Administrative tasks are delegated with the narrowest built-in or custom role that covers them\n(Exchange Administrator, SharePoint Administrator, User Administrator, Helpdesk Administrator,\nSecurity Operator...), scoped to an administrative unit where possible. Global Administrator is\nkept for the few tasks only it can perform.\n\nMeasurable target: Global Administrator holders are fewer than half of all principals holding a\nprivileged role (active or eligible).\n",
    "rationale": "Most daily administration needs a fraction of Global Administrator's permissions. Narrow roles\nlimit what a stolen admin session can do and make the audit trail easier to read. A tenant where\nmost privileged users are Global Administrators has in practice no role separation.\n",
    "impact": "Administrators may need several roles, or a custom role (Microsoft Entra ID P1) for a precise\nset of permissions. Some admin center pages require a specific role; test each delegation with\nthe person who will use it.\n",
    "notes": "The ratio is a signal, not a goal: a tenant with two Global Administrators and two other admins\npasses, but role design still deserves a review.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Roles & admins** > **Roles & admins**, filter on **Privileged**\n   roles and note the active and eligible holders of each, expanding groups.\n3. Count the distinct principals holding Global Administrator (G) and the distinct principals\n   holding any privileged role (P).\n4. Read-only PowerShell alternative (Microsoft Graph, scope `RoleManagement.Read.Directory`):\n   ```\n   $priv = Get-MgRoleManagementDirectoryRoleDefinition -All | Where-Object IsPrivileged\n   $all  = Get-MgRoleManagementDirectoryRoleAssignment -All | Where-Object RoleDefinitionId -in $priv.Id\n   ```\n   Add eligible assignments with `Get-MgRoleManagementDirectoryRoleEligibilitySchedule`.\n5. Fail if G is half of P or more, or if a Global Administrator's activity (audit logs) only\n   concerns one service.\n"
    },
    "remediation": {
      "manual": "1. For each Global Administrator, list the tasks performed over the last 90 days in\n   **Entra ID** > **Monitoring & health** > **Audit logs** and the admin centers used.\n2. Map those tasks to built-in roles (see the least-privileged roles by task page) or create\n   a custom role.\n3. Assign the narrower roles, eligible through PIM where licensed, with a Privileged Role\n   Administrator.\n4. Remove the Global Administrator assignment once the person confirms the new roles work.\n",
      "rollback": "Reassign Global Administrator temporarily through PIM while the role design is fixed.\n"
    },
    "references": [
      {
        "title": "Least privileged roles by task in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/delegate-by-task",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Best practices for Microsoft Entra roles",
        "url": "https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R39",
        "relation": "partial",
        "note": "Applied to Microsoft Entra directory roles only."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-003",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}