Detections
Analytics

MS.AAD.7.7v1 - Eligible and active highly privileged role assignments SHALL trigger an alert.

Information

Closely monitor assignment of the highest privileged roles for signs of compromise. Send assignment alerts to enable the security monitoring team to detect compromise attempts.

Solution

1. In the Microsoft Entra Portal, under Identity Governance, select Privileged Identity Management (PIM), and then under Manage, select Microsoft Entra roles.

2. Under Manage, select Roles. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example:

 1. Click the Global Administrator role.
 2. Click Settings and then click Edit.
 3. Click the Notification tab.
 4. Under Send notifications when members are assigned as eligible to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.
 5. Under Send notifications when members are assigned as active to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.
 6. Click Update.

3. For each of the highly privileged roles, if they have any PIM groups actively assigned to them, apply the same configurations as steps 2-8 above to each PIM group's Member settings.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1)

Plugin: microsoft_azure

Control ID: f60c64c8f668f9b1f37e7c46be35d7141238da973ce5385538d05179c3f2614e