Control: 5.26 Ensure fewer than 5 users have global administrator assignment

Description

This recommendation aims to maintain a balance between security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy, while limiting the number to four reduces the risk of excessive privileged access.

Remediation

Remediate from Azure Portal

From Azure Home select the Portal Menu.
Select Microsoft Entra ID.
Under Manage, select Roles and administrators.
Under Administrative Roles, select Global Administrator.

If more than 4 users are assigned:

Remove Global Administrator role for users which do not or no longer require the role.
Assign Global Administrator role via PIM which can be activated when required.
Assign more granular roles to users to conduct their duties.

If only one user is assigned:

Provide the Global Administrator role to a trusted user or create a break glass admin account.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_5_26

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_5_26 --share

SQL

This control uses a named query:

with distinct_tenant as (
  select
    distinct tenant_id,
    title,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  t.tenant_id as resource,
  case
    when jsonb_array_length(member_ids) >= 2 and jsonb_array_length(member_ids) < 5 then 'ok'
    else 'alarm'
  end as status,
  t.title || ' has ' ||  (jsonb_array_length(member_ids)) || ' users with global administrator assignment.'  as reason,
  t.tenant_id
  
from
  distinct_tenant as t,
  azuread_directory_role
where
  display_name = 'Global Administrator'

Control: 5.26 Ensure fewer than 5 users have global administrator assignment

Description

Remediation

Usage

SQL

Tags