Remove unused and orphaned privileged role assignments

Description

No privileged role (active or eligible) is held by:

• a disabled account, or a deleted account still present as an orphaned assignment;
• an account that has not signed in for {{ stale_days }} days;
• an eligible user who has not activated the role for {{ stale_days }} days, or an active holder who has not used it in that period (PIM alert Administrators aren't using their privileged roles).

The emergency access accounts (CB-M365-ADMIN-002) are excluded from the inactivity criteria.

Rationale

Unused privileges add attack surface for no benefit. A dormant admin account is rarely watched, its owner would not notice a takeover, and its methods may be outdated. Removing such assignments between periodic reviews keeps the privileged population close to the real need.

Impact

Occasional administrators (yearly tasks, backup staff) lose their eligibility and must ask for it again. Document such cases as exceptions rather than lowering the threshold for everyone.

Applies when

Requires: Microsoft Entra ID P2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts and open Administrators aren't using their privileged roles (set its threshold to {{ stale_days }} days in Setting if needed).
3. In Assignments, list eligible and active holders; for each, open the user and check Account enabled and the last sign-in date (Sign-in logs or the user overview).
4. Read-only PowerShell alternative (Microsoft Graph, scopes RoleManagement.Read.Directory, AuditLog.Read.All):

   Get-MgUser -UserId <id> -Property AccountEnabled,SignInActivity |
     Select-Object AccountEnabled, @{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}}
   

   and GET /roleManagement/directory/roleAssignmentScheduleRequests to find the last activation per principal.
5. Fail if a privileged assignment belongs to a disabled account, to an account without a sign-in for {{ stale_days }} days, or to a user who has not used the role in that period, outside documented exceptions.

Remediation

1. With a Privileged Role Administrator, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments.
2. For each finding, confirm with the owner's manager, then select Remove on the assignment.
3. Disable the admin account if it holds no other role.
4. Equivalent with Microsoft Graph: New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -Action adminRemove (eligible) or New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action adminRemove (active).

Rollback

Reassign the role as eligible in PIM.

References

• Configure security alerts for Microsoft Entra roles in PIM Microsoft, vendor-doc, accessed 2026-10-24
• How to manage inactive user accounts Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
• related CB-M365-ADMIN-010 Review privileged role assignments periodically
• related CB-M365-AUTH-047 Disable accounts with no successful sign-in for {{ inactive_days }} days

People and lifecycle