Restrict the Microsoft Entra admin center to administrators

Description

The user setting Restrict access to Microsoft Entra admin center is set to Yes: users without an administrative role cannot load the common pages of the Microsoft Entra admin center and the Azure portal (home, tenant overview, user list).

Microsoft states that this is not a security boundary: it does not block Microsoft Graph, PowerShell or deep links to most pages. Directory read access by members is reduced with other settings; blocking non-admin access to Azure management uses a Conditional Access policy on Windows Azure Service Management API.

Rationale

An attacker with a regular user account often starts by listing users, groups and roles to pick the next target. This setting adds friction to that browsing for little cost.

Impact

Non-administrators who own groups or applications can no longer manage them from the admin center; they use My Groups, My Apps, or get a reader role. The setting does not apply to users with any admin role, including custom roles.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Users > User settings.
3. Fail if Restrict access to Microsoft Entra admin center is No. There is no public API for this setting.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator (or Global Administrator).
2. Browse to Entra ID > Users > User settings.
3. Set Restrict access to Microsoft Entra admin center to Yes and select Save.
4. Give a reader role (for example Global Reader or Directory Readers) to non-administrators who have a documented need for the portal.

Rollback

Set the option back to No.

References

• What are the default user permissions in Microsoft Entra ID? Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle