{
  "id": "CB-M365-ADMIN-008",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-008",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-008.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-008.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-008",
    "title": "Require approval to activate the Privileged Role Administrator role",
    "finding": {
      "title": "Privileged Role Administrator can be activated without approval",
      "description": "A user eligible for Privileged Role Administrator can grant themselves the role in PIM with no second person involved, including an attacker holding that account."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "pim",
      "approval",
      "four-eyes"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "In Privileged Identity Management, the role settings of **Privileged Role Administrator** set **Require approval to\nactivate** to **Yes**, with at least two approvers. Approvers are named administrators who are\nnot the only eligible users of the role, so nobody approves their own activation.\n",
    "rationale": "Privileged Role Administrator can assign any role, including Global Administrator, and change\nPIM settings. An attacker who activates it without approval can grant themselves every other\nprivilege, so this role needs the same approval step as Global Administrator.\n",
    "impact": "Activations wait for an approver: plan approvers in several time zones or on-call rotations, so\nthat urgent work is not blocked. The emergency access accounts are permanently active and do not\ndepend on approval. Approvers receive an email and approve in **My Access** or PIM.\n",
    "notes": "PIM does not let users approve their own requests, but if the only approvers are also the only\neligible users, two of them can approve each other: keep a separate approver.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra\n   roles** > **Roles** > **Privileged Role Administrator** > **Role settings**.\n3. Under **Activation**, check that **Require approval to activate** is **Yes** and that the\n   approver list has at least two users or a group with at least two members.\n4. Read-only alternative with Microsoft Graph (scope `RoleManagementPolicy.Read.Directory`):\n   `GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole' and roleDefinitionId eq 'e8611ab8-c189-46e8-94e1-60213ab1f814'&$expand=policy($expand=rules)`,\n   then read the rule `Approval_EndUser_Assignment`: `setting.isApprovalRequired` is\n   `true` and `approvalStages[0].primaryApprovers` is not empty.\n5. Fail if approval is not required or if fewer than two approvers are configured.\n"
    },
    "remediation": {
      "manual": "1. With a Privileged Role Administrator, browse to **ID Governance** > **Privileged Identity\n   Management** > **Microsoft Entra roles** > **Roles** > **Privileged Role Administrator** > **Role settings** >\n   **Edit**.\n2. On the **Activation** tab, check **Require approval to activate** and select at least two\n   approvers (users or a group).\n3. Select **Update**. Tell eligible users and approvers about the new step.\n4. Equivalent with Microsoft Graph: `PATCH /policies/roleManagementPolicies/{policyId}/rules/Approval_EndUser_Assignment`\n   with `isApprovalRequired: true` and the approvers in `approvalStages`.\n",
      "rollback": "Uncheck **Require approval to activate** in the role settings.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Entra role settings in Privileged Identity Management",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Approve or deny requests for Microsoft Entra roles in PIM",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-approval-workflow",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(5)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-007",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}