Description
A Global Administrator can turn on Access management for Azure resources in the tenant
properties. Microsoft then assigns that user the Azure User Access Administrator role at the
root scope (/), above every management group and subscription. The elevation is meant for a
one-off recovery task and must be turned off right after.
No user holds User Access Administrator at root scope outside a documented intervention.
The toggle is per user: it only shows and changes the state of the signed-in Global
Administrator. To find every holder, list role assignments at scope /. Tenants with no Azure
subscription are still exposed if one is created later.
Rationale
An attacker who takes over a Global Administrator account can use the elevation to grant themselves Owner on every subscription, reach virtual machines, key vaults and storage, and pivot from Microsoft 365 to Azure workloads. A lingering root assignment also bypasses the role reviews done at subscription level.
Impact
None known. The elevation can be turned on again when a recovery task needs it.
Setting
| Location | Microsoft Entra admin center > Entra ID > Overview > Properties > Access management for Azure resources |
| Default | No |
| Recommended | No |
Audit
- Sign in to the Azure portal (https://portal.azure.com) with an account that can read role assignments at root scope (for example a Global Administrator who temporarily elevates, or a Reader at root management group).
- Run in Azure Cloud Shell (read-only):
Get-AzRoleAssignment -Scope "/" | Where-Object RoleDefinitionName -eq 'User Access Administrator'oraz role assignment list --scope "/" --role "User Access Administrator". - In the Microsoft Entra admin center, browse to Entra ID > Overview > Properties and read Access management for Azure resources for each Global Administrator account in use.
- Fail if a user holds User Access Administrator at scope
/without an open, documented intervention.
Remediation
- Each Global Administrator who turned it on signs in to the Microsoft Entra admin center, browses to Entra ID > Overview > Properties, sets Access management for Azure resources to No and selects Save.
- For a former holder who cannot sign in, remove the assignment with
Remove-AzRoleAssignment -SignInName <upn> -RoleDefinitionName 'User Access Administrator' -Scope "/". - Create an alert on the audit event for elevated access (Azure Monitor activity log,
operation
Microsoft.Authorization/elevateAccess/action) and route it to the SOC.
References
- Elevate access to manage all Azure subscriptions and management groups Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI - Recommandations relatives à l'administration sécurisée des systèmes d'information3.0 | R39 | partial | Applies least privilege to the Entra ID to Azure elevation path only. |
| NIST SP 800-53 Rev. 55.1.1 | AC-6(5) | related | |
| NIST SP 800-53 Rev. 55.1.1 | AC-2(7) | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1098 |
| MITRE ATT&CK | T1078.004 |
Related controls
- related
CB-M365-ADMIN-003Keep between two and four Global Administrators - related
CB-M365-ADMIN-006Grant highly privileged roles just in time through Privileged Identity Management
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
