{
  "id": "CB-M365-ADMIN-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-007.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-007",
    "title": "Require approval to activate the Global Administrator role",
    "finding": {
      "title": "Global Administrator can be activated without approval",
      "description": "A user eligible for Global Administrator can grant themselves the role in PIM with no second person involved, including an attacker holding that account."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "pim",
      "approval",
      "four-eyes"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "In Privileged Identity Management, the role settings of **Global Administrator** set **Require approval to\nactivate** to **Yes**, with at least two approvers. Approvers are named administrators who are\nnot the only eligible users of the role, so nobody approves their own activation.\n",
    "rationale": "Global Administrator controls every service and every role. Requiring a second person to\napprove each activation stops an attacker who has taken over an eligible account from becoming\nGlobal Administrator on their own, and makes every activation a deliberate, visible event.\n",
    "impact": "Activations wait for an approver: plan approvers in several time zones or on-call rotations, so\nthat urgent work is not blocked. The emergency access accounts are permanently active and do not\ndepend on approval. Approvers receive an email and approve in **My Access** or PIM.\n",
    "notes": "PIM does not let users approve their own requests, but if the only approvers are also the only\neligible users, two of them can approve each other: keep a separate approver.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra\n   roles** > **Roles** > **Global Administrator** > **Role settings**.\n3. Under **Activation**, check that **Require approval to activate** is **Yes** and that the\n   approver list has at least two users or a group with at least two members.\n4. Read-only alternative with Microsoft Graph (scope `RoleManagementPolicy.Read.Directory`):\n   `GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'&$expand=policy($expand=rules)`,\n   then read the rule `Approval_EndUser_Assignment`: `setting.isApprovalRequired` is\n   `true` and `approvalStages[0].primaryApprovers` is not empty.\n5. Fail if approval is not required or if fewer than two approvers are configured.\n"
    },
    "remediation": {
      "manual": "1. With a Privileged Role Administrator, browse to **ID Governance** > **Privileged Identity\n   Management** > **Microsoft Entra roles** > **Roles** > **Global Administrator** > **Role settings** >\n   **Edit**.\n2. On the **Activation** tab, check **Require approval to activate** and select at least two\n   approvers (users or a group).\n3. Select **Update**. Tell eligible users and approvers about the new step.\n4. Equivalent with Microsoft Graph: `PATCH /policies/roleManagementPolicies/{policyId}/rules/Approval_EndUser_Assignment`\n   with `isApprovalRequired: true` and the approvers in `approvalStages`.\n",
      "rollback": "Uncheck **Require approval to activate** in the role settings.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Entra role settings in Privileged Identity Management",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Approve or deny requests for Microsoft Entra roles in PIM",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-approval-workflow",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.7.6v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}