Detections
Analytics

1.1.3 Ensure that between two and four global admins are designated

Information

Between two and four global administrators should be designated in the tenant. Ideally, these accounts will not have licenses assigned to them which supports additional controls found in this benchmark.

The Global Administrator role grants unrestricted access across all services in Microsoft Entra ID and should never be used for routine daily activities. Limiting the number of Global Administrators reduces the attack surface of the tenant and aligns with the principle of least privilege.

Fewer than two Global Administrators creates a single point of failure and removes the peer oversight needed to detect unauthorized actions. More than four increases the likelihood of account compromise by an external attacker. Maintaining between two and four Global Administrators balances operational redundancy against privileged access risk.

For any accounts assigned the Global Administrator role, at least one strong authentication method such as a FIDO2 key or certificate is strongly advised.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to the Microsoft 365 admin center https://admin.microsoft.com
 - Select Users > Active Users.
 - In the Search field enter the name of the user to be made a Global Administrator.
 - To create a new Global Admin:

 - Select the user's name.
 - A window will appear to the right.
 - Select Manage roles.
 - Select Admin center access.
 - Check Global Administrator.
 - Click Save changes.

 - To remove a Global Admin:

 - In the Search field, enter the name of the user to be removed.
 - Select the user's name.
 - A window will appear to the right.
 - Under Roles, select Manage roles.
 - Uncheck Global Administrator.
 - Click Save changes.

Impact:

The potential impact associated with ensuring compliance with this requirement is dependent upon the current number of global administrators configured in the tenant. If there is only one global administrator in a tenant, an additional global administrator will need to be identified and configured. If there are more than four global administrators, a review of role requirements for current global administrators will be required to identify which of the users require global administrator access.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), CSCv7|4.1

Plugin: microsoft_azure

Control ID: c8c733f7f122640cc9753f11233e273218e11053e3e584cdab7ab124e521c5cb