Detections
Analytics

5.1.2.4 Ensure access to the Entra admin center is restricted

Information

This setting restricts non-administrators from loading a set of frequently visited pages in the Microsoft Entra admin center and Azure portal, including home, tenant overview, and the users list.

What does it not do?

 - It does not block programmatic access to Microsoft Entra data via PowerShell, Microsoft Graph API, or other tools like Visual Studio.
 - It does not apply to users with an administrative role, including custom roles.
 - It does not prevent all access to the admin center. Many areas are still reachable through alternate paths.

The Microsoft Entra admin center contains sensitive data and permission settings, which are still enforced based on the user's role. However, an end user may inadvertently change properties or account settings on their own account. This could result in increased administrative overhead.

Additionally, a compromised end-user account could be used to enumerate tenant structure, users, and group memberships to support privilege escalation or lateral movement.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/
 - Expand Entra ID > Users and select User settings.
 - Set Restrict access to Microsoft Entra admin center to Yes then Save.

Impact:

Non-administrators who own groups will be unable to reach group management pages through the standard admin center navigation. Self-service access to other portal-facing features may also be affected depending on the navigation path used. Because the restriction targets specific frequently accessed pages rather than all portal content, users with direct (deep) links to other admin center sections may still be able to access them.

Note: Users will still be able to sign into Microsoft Entra admin center but will be unable to see directory information.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), 800-53|MP-2

Plugin: microsoft_azure

Control ID: 2df97864a61b31a10e65646910c522ab00a2825ec61f080f6d3986264b620505