EIDPIM-001: Global Administrator Enumeration
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- Info
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The Global Administrator role grants unrestricted access to all Microsoft 365 and Entra ID services, making it the highest-privilege role in the tenant. Organizations should maintain a minimum of 2 and a maximum of 4 Global Administrators to balance operational resilience with least-privilege principles. Excessive Global Administrator assignments dramatically expand the attack surface for credential theft and tenant-wide compromise
Recommended value
2-4 Global Admins maximum
Remediation
Navigate to Entra ID > Roles and administrators > Global Administrator and review all assigned users. Remove unnecessary permanent assignments and ensure no more than 4 accounts hold this role. Convert permanent assignments to PIM eligible assignments where possible
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.7.1v1
- NIST SP 800-53
- AC-2, AC-6(5)
- CIS M365 Benchmark
- 1.1.1
- MITRE ATT&CK
- T1078.004