cirsec Baselines
Esc
Microsoft 365 tenant · Privileged access & administration

Require approval to activate the Global Administrator role

When it fails: Global Administrator can be activated without approval. A user eligible for Global Administrator can grant themselves the role in PIM with no second person involved, including an attacker holding that account.

CB-M365-ADMIN-007mediumactivemanualprofile baseline

Description

In Privileged Identity Management, the role settings of Global Administrator set Require approval to activate to Yes, with at least two approvers. Approvers are named administrators who are not the only eligible users of the role, so nobody approves their own activation.

PIM does not let users approve their own requests, but if the only approvers are also the only eligible users, two of them can approve each other: keep a separate approver.

Rationale

Global Administrator controls every service and every role. Requiring a second person to approve each activation stops an attacker who has taken over an eligible account from becoming Global Administrator on their own, and makes every activation a deliberate, visible event.

Impact

Activations wait for an approver: plan approvers in several time zones or on-call rotations, so that urgent work is not blocked. The emergency access accounts are permanently active and do not depend on approval. Approvers receive an email and approve in My Access or PIM.

Applies when

Requires: Microsoft Entra ID P2

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles > Global Administrator > Role settings.
  3. Under Activation, check that Require approval to activate is Yes and that the approver list has at least two users or a group with at least two members.
  4. Read-only alternative with Microsoft Graph (scope RoleManagementPolicy.Read.Directory): GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'&$expand=policy($expand=rules), then read the rule Approval_EndUser_Assignment: setting.isApprovalRequired is true and approvalStages[0].primaryApprovers is not empty.
  5. Fail if approval is not required or if fewer than two approvers are configured.

Remediation

  1. With a Privileged Role Administrator, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles > Global Administrator > Role settings > Edit.
  2. On the Activation tab, check Require approval to activate and select at least two approvers (users or a group).
  3. Select Update. Tell eligible users and approvers about the new step.
  4. Equivalent with Microsoft Graph: PATCH /policies/roleManagementPolicies/{policyId}/rules/Approval_EndUser_Assignment with isApprovalRequired: true and the approvers in approvalStages.

Rollback

Uncheck Require approval to activate in the role settings.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-6(5)related
NIST SP 800-53 Rev. 55.1.1AC-3(2)related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.7.6v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1098
  • related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
  • related CB-M365-ADMIN-008 Require approval to activate the Privileged Role Administrator role

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr