Detections
Analytics

MS.AAD.7.8v1 - User activation of the Global Administrator role SHALL trigger an alert.

Information

Closely monitor activation of the Global Administrator role for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts.

Solution

1. In the Microsoft Entra Portal, under Identity Governance, select Privileged Identity Management (PIM). Under Manage, select Microsoft Entra roles.

2. Click the Global Administrator role.

3. Click Settings then click Edit.

4. Click the Notification tab.

5. Under Send notifications when eligible members activate this role, in the Role activation alert select the Additional recipients textbox and enter the email address of the security monitoring mailbox configured to receive Global Administrator activation alerts.

6. Click Update.

7. If the Global Administrator role has any PIM groups actively assigned to it, then also apply the same configurations per the steps above to each PIM group's Member settings.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9)

Plugin: microsoft_azure

Control ID: 4953d652a773e1bbad6346ce6084b58395d96e3a85ca12208f37daf80d811dfb