{
  "id": "CB-M365-ADMIN-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-006",
    "title": "Grant highly privileged roles just in time through Privileged Identity Management",
    "finding": {
      "title": "Highly privileged roles are permanently active or assigned outside PIM",
      "description": "Standing privileged sessions give an attacker who steals an admin account immediate control, with no activation, justification or approval step."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "pim",
      "just-in-time",
      "least-privilege"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "parameters": [
      {
        "name": "highly_privileged_roles",
        "type": "list",
        "description": "Built-in roles that must never hold permanent active assignments.",
        "default": [
          "Global Administrator",
          "Privileged Role Administrator",
          "Privileged Authentication Administrator",
          "Security Administrator",
          "User Administrator",
          "Exchange Administrator",
          "SharePoint Administrator",
          "Hybrid Identity Administrator",
          "Application Administrator",
          "Cloud Application Administrator"
        ]
      }
    ],
    "description": "The roles in `{{ highly_privileged_roles }}` are only assigned as **eligible** in Microsoft Entra\nPrivileged Identity Management (PIM): holders activate the role for a limited time when they need\nit. No active assignment is permanent, and the role settings forbid permanent active assignments.\nAssignments are made through PIM only, not directly in **Roles & admins** or by a third-party\ntool that bypasses PIM.\n\nThe emergency access accounts (CB-M365-ADMIN-002) are the only permanent active Global\nAdministrators.\n",
    "rationale": "With just-in-time access, a stolen admin account has no privilege until the attacker manages to\nactivate the role, which requires MFA, a justification and possibly an approval, and raises an\nalert. Activations are time-bound, so privileges disappear when the work is done. Assignments\nmade outside PIM escape these settings and the PIM audit trail.\n",
    "impact": "Administrators activate their role before each admin session, which adds a minute and needs\nMFA. Automation that relies on a user holding a role must move to a workload identity with the\nright application permissions. Every eligible user needs an Entra ID P2 (or ID Governance)\nlicense.\n",
    "notes": "PIM settings are per role. Groups assigned to roles can be managed with PIM for Groups; their\nmembership then follows the same rules.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra\n   roles** > **Assignments** > **Active assignments**. For each role in the list, any active\n   assignment with **End time** **Permanent** other than the emergency access accounts is a\n   finding.\n3. Browse to **Roles**, open each role > **Role settings**: under **Assignment**, **Allow\n   permanent active assignment** is **No**.\n4. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**, filter on **Category**\n   **RoleManagement** and **Activity** **Add member to role**: entries not initiated by\n   **MS-PIM** show assignments made outside PIM.\n5. Read-only PowerShell alternative (Microsoft Graph, scope `RoleManagement.Read.Directory`):\n   ```\n   Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All -ExpandProperty RoleDefinition |\n     Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime } |\n     Select-Object PrincipalId, @{n='Role';e={$_.RoleDefinition.DisplayName}}\n   ```\n6. Fail if a listed role has a permanent active assignment other than the emergency\n   accounts, if permanent active assignment is allowed in its settings, or if assignments are\n   made outside PIM.\n"
    },
    "remediation": {
      "manual": "1. With a Privileged Role Administrator, browse to **ID Governance** > **Privileged Identity\n   Management** > **Microsoft Entra roles** > **Roles**, open each listed role > **Role\n   settings** > **Edit**.\n2. **Activation**: maximum duration 8 hours or less, require MFA (or the phishing-resistant\n   authentication context) and a justification.\n3. **Assignment**: set **Allow permanent active assignment** to **No** and **Expire active\n   assignments after** to a short period.\n4. In **Assignments** > **Active assignments**, for each permanent assignment except the\n   emergency accounts, select **Update** and change it to **Eligible**, or remove it and add\n   an eligible assignment.\n5. Tell administrators to activate roles from **My roles** in PIM, and stop direct\n   assignments in **Roles & admins**.\n6. Equivalent with Microsoft Graph: `New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest`\n   to create the eligible assignment, then\n   `New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action adminRemove` to remove\n   the active one.\n",
      "rollback": "Convert the eligible assignment back to active in PIM with a Privileged Role Administrator or\nan emergency access account.\n"
    },
    "references": [
      {
        "title": "Plan a Privileged Identity Management deployment",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-deployment-plan",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure Microsoft Entra role settings in Privileged Identity Management",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Assign Microsoft Entra roles in Privileged Identity Management",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-add-role-to-user",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.4v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.5v1",
        "relation": "equivalent"
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R39",
        "relation": "partial",
        "note": "Covers time-bound privilege on highly privileged Entra roles only."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(6)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1098"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-001",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-007",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-008",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-009",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-010",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-011",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-014",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-018",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}