EIDPIM-003: Permanent Privileged Role Assignments
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Permanent (active) privileged role assignments provide standing administrative access without time limits or activation requirements. These permanent assignments should be converted to eligible (just-in-time) assignments via PIM, which require explicit activation with justification, approval, and time-bound access windows. Standing privileged access increases the risk and impact of credential compromise because the attacker gains immediate elevated access without any additional gates
Recommended value
No permanent privileged role assignments except for break-glass accounts. All other privileged assignments should be PIM eligible
Remediation
Navigate to Entra ID > Roles and administrators and identify all permanent role assignments. Convert each permanent assignment to an eligible assignment through PIM by removing the active assignment and creating a corresponding eligible assignment. Only break-glass accounts should retain permanent Global Administrator assignments
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.7.4v1
- NIST SP 800-53
- AC-2(3), AC-6(1)
- CIS M365 Benchmark
- 1.1.3
- MITRE ATT&CK
- T1078.004