{
  "id": "CB-M365-ADMIN-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-011.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-011",
    "title": "Remove unused and orphaned privileged role assignments",
    "finding": {
      "title": "Privileged roles are held by disabled, inactive or non-using accounts",
      "description": "Dormant privileged accounts are easy targets, because nobody notices when they are used again."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "privileged-access",
      "pim",
      "hygiene",
      "inactive-accounts"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "parameters": [
      {
        "name": "stale_days",
        "type": "integer",
        "description": "Number of days without sign-in or without role activation after which a privileged assignment is considered unused.",
        "unit": "days",
        "default": 90,
        "minimum": 30
      }
    ],
    "description": "No privileged role (active or eligible) is held by:\n\n- a disabled account, or a deleted account still present as an orphaned assignment;\n- an account that has not signed in for `{{ stale_days }}` days;\n- an eligible user who has not activated the role for `{{ stale_days }}` days, or an active\n  holder who has not used it in that period (PIM alert **Administrators aren't using their\n  privileged roles**).\n\nThe emergency access accounts (CB-M365-ADMIN-002) are excluded from the inactivity criteria.\n",
    "rationale": "Unused privileges add attack surface for no benefit. A dormant admin account is rarely watched,\nits owner would not notice a takeover, and its methods may be outdated. Removing such assignments\nbetween periodic reviews keeps the privileged population close to the real need.\n",
    "impact": "Occasional administrators (yearly tasks, backup staff) lose their eligibility and must ask for\nit again. Document such cases as exceptions rather than lowering the threshold for everyone.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra\n   roles** > **Alerts** and open **Administrators aren't using their privileged roles** (set\n   its threshold to `{{ stale_days }}` days in **Setting** if needed).\n3. In **Assignments**, list eligible and active holders; for each, open the user and check\n   **Account enabled** and the last sign-in date (**Sign-in logs** or the user overview).\n4. Read-only PowerShell alternative (Microsoft Graph, scopes `RoleManagement.Read.Directory`,\n   `AuditLog.Read.All`):\n   ```\n   Get-MgUser -UserId <id> -Property AccountEnabled,SignInActivity |\n     Select-Object AccountEnabled, @{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}}\n   ```\n   and `GET /roleManagement/directory/roleAssignmentScheduleRequests` to find the last\n   activation per principal.\n5. Fail if a privileged assignment belongs to a disabled account, to an account without a\n   sign-in for `{{ stale_days }}` days, or to a user who has not used the role in that\n   period, outside documented exceptions.\n"
    },
    "remediation": {
      "manual": "1. With a Privileged Role Administrator, browse to **ID Governance** > **Privileged Identity\n   Management** > **Microsoft Entra roles** > **Assignments**.\n2. For each finding, confirm with the owner's manager, then select **Remove** on the\n   assignment.\n3. Disable the admin account if it holds no other role.\n4. Equivalent with Microsoft Graph:\n   `New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -Action adminRemove` (eligible)\n   or `New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest -Action adminRemove`\n   (active).\n",
      "rollback": "Reassign the role as eligible in PIM.\n"
    },
    "references": [
      {
        "title": "Configure security alerts for Microsoft Entra roles in PIM",
        "url": "https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "How to manage inactive user accounts",
        "url": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-manage-inactive-user-accounts",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(7)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(3)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-010",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-047",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}