{
  "id": "CB-M365-ADMIN-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-ADMIN-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-ADMIN-013",
    "title": "Restrict the Microsoft Entra admin center to administrators",
    "finding": {
      "title": "Any user can browse the Microsoft Entra admin center",
      "description": "Non-administrators can open the admin center and browse users, groups and tenant information, which helps reconnaissance after an account compromise."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "admin-portal",
      "reconnaissance",
      "user-settings"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Users > User settings > Restrict access to Microsoft Entra admin center",
      "default_value": "No",
      "recommended_value": "Yes"
    },
    "description": "The user setting **Restrict access to Microsoft Entra admin center** is set to **Yes**: users\nwithout an administrative role cannot load the common pages of the Microsoft Entra admin center\nand the Azure portal (home, tenant overview, user list).\n",
    "rationale": "An attacker with a regular user account often starts by listing users, groups and roles to pick\nthe next target. This setting adds friction to that browsing for little cost.\n",
    "impact": "Non-administrators who own groups or applications can no longer manage them from the admin\ncenter; they use My Groups, My Apps, or get a reader role. The setting does not apply to users\nwith any admin role, including custom roles.\n",
    "notes": "Microsoft states that this is not a security boundary: it does not block Microsoft Graph,\nPowerShell or deep links to most pages. Directory read access by members is reduced with other\nsettings; blocking non-admin access to Azure management uses a Conditional Access policy on\n**Windows Azure Service Management API**.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Fail if **Restrict access to Microsoft Entra admin center** is **No**. There is no public\n   API for this setting.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Privileged Role Administrator\n   (or Global Administrator).\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Set **Restrict access to Microsoft Entra admin center** to **Yes** and select **Save**.\n4. Give a reader role (for example Global Reader or Directory Readers) to non-administrators\n   who have a documented need for the portal.\n",
      "rollback": "Set the option back to **No**.\n"
    },
    "references": [
      {
        "title": "What are the default user permissions in Microsoft Entra ID?",
        "url": "https://learn.microsoft.com/entra/fundamentals/users-default-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1087.004"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}