# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-ADMIN-006
title: Grant highly privileged roles just in time through Privileged Identity Management
finding:
  title: Highly privileged roles are permanently active or assigned outside PIM
  description: Standing privileged sessions give an attacker who steals an admin account immediate control, with no activation, justification or approval step.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [privileged-access, pim, just-in-time, least-privilege]

applicability:
  requires:
    - "Microsoft Entra ID P2"

parameters:
  - name: highly_privileged_roles
    type: list
    description: Built-in roles that must never hold permanent active assignments.
    default:
      - Global Administrator
      - Privileged Role Administrator
      - Privileged Authentication Administrator
      - Security Administrator
      - User Administrator
      - Exchange Administrator
      - SharePoint Administrator
      - Hybrid Identity Administrator
      - Application Administrator
      - Cloud Application Administrator

description: |
  The roles in `{{ highly_privileged_roles }}` are only assigned as **eligible** in Microsoft Entra
  Privileged Identity Management (PIM): holders activate the role for a limited time when they need
  it. No active assignment is permanent, and the role settings forbid permanent active assignments.
  Assignments are made through PIM only, not directly in **Roles & admins** or by a third-party
  tool that bypasses PIM.

  The emergency access accounts (CB-M365-ADMIN-002) are the only permanent active Global
  Administrators.
rationale: |
  With just-in-time access, a stolen admin account has no privilege until the attacker manages to
  activate the role, which requires MFA, a justification and possibly an approval, and raises an
  alert. Activations are time-bound, so privileges disappear when the work is done. Assignments
  made outside PIM escape these settings and the PIM audit trail.
impact: |
  Administrators activate their role before each admin session, which adds a minute and needs
  MFA. Automation that relies on a user holding a role must move to a workload identity with the
  right application permissions. Every eligible user needs an Entra ID P2 (or ID Governance)
  license.
notes: |
  PIM settings are per role. Groups assigned to roles can be managed with PIM for Groups; their
  membership then follows the same rules.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra
       roles** > **Assignments** > **Active assignments**. For each role in the list, any active
       assignment with **End time** **Permanent** other than the emergency access accounts is a
       finding.
    3. Browse to **Roles**, open each role > **Role settings**: under **Assignment**, **Allow
       permanent active assignment** is **No**.
    4. Browse to **Entra ID** > **Monitoring & health** > **Audit logs**, filter on **Category**
       **RoleManagement** and **Activity** **Add member to role**: entries not initiated by
       **MS-PIM** show assignments made outside PIM.
    5. Read-only PowerShell alternative (Microsoft Graph, scope `RoleManagement.Read.Directory`):
       ```
       Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -All -ExpandProperty RoleDefinition |
         Where-Object { $_.AssignmentType -eq 'Assigned' -and -not $_.EndDateTime } |
         Select-Object PrincipalId, @{n='Role';e={$_.RoleDefinition.DisplayName}}
       ```
    6. Fail if a listed role has a permanent active assignment other than the emergency
       accounts, if permanent active assignment is allowed in its settings, or if assignments are
       made outside PIM.

remediation:
  manual: |
    1. With a Privileged Role Administrator, browse to **ID Governance** > **Privileged Identity
       Management** > **Microsoft Entra roles** > **Roles**, open each listed role > **Role
       settings** > **Edit**.
    2. **Activation**: maximum duration 8 hours or less, require MFA (or the phishing-resistant
       authentication context) and a justification.
    3. **Assignment**: set **Allow permanent active assignment** to **No** and **Expire active
       assignments after** to a short period.
    4. In **Assignments** > **Active assignments**, for each permanent assignment except the
       emergency accounts, select **Update** and change it to **Eligible**, or remove it and add
       an eligible assignment.
    5. Tell administrators to activate roles from **My roles** in PIM, and stop direct
       assignments in **Roles & admins**.
    6. Equivalent with Microsoft Graph: `New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest`
       to create the eligible assignment, then
       `New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action adminRemove` to remove
       the active one.
  rollback: |
    Convert the eligible assignment back to active in PIM with a Privileged Role Administrator or
    an emergency access account.

references:
  - title: Plan a Privileged Identity Management deployment
    url: https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-deployment-plan
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Configure Microsoft Entra role settings in Privileged Identity Management
    url: https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Assign Microsoft Entra roles in Privileged Identity Management
    url: https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-add-role-to-user
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.3.1"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.AAD.7.4v1
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.AAD.7.5v1
    relation: equivalent
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R39"
    relation: partial
    note: Covers time-bound privilege on highly privileged Entra roles only.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2(6)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6(5)
    relation: related
threats:
  - framework: mitre-attack
    id: T1078.004
  - framework: mitre-attack
    id: T1098
related_controls:
  - id: CB-M365-ADMIN-001
    type: related
  - id: CB-M365-ADMIN-002
    type: related
  - id: CB-M365-ADMIN-007
    type: related
  - id: CB-M365-ADMIN-008
    type: related
  - id: CB-M365-ADMIN-009
    type: related
  - id: CB-M365-ADMIN-010
    type: related
  - id: CB-M365-ADMIN-011
    type: related
  - id: CB-M365-ADMIN-014
    type: related
  - id: CB-M365-ADMIN-018
    type: related
  - id: CB-M365-AUDIT-012
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24