EIDPIM-013: Separate Admin Account Enforcement
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Administrative actions should be performed from dedicated administrative accounts rather than the same accounts used for daily activities such as email, web browsing, and collaboration. Using a single account for both administrative and daily tasks exposes privileged credentials to phishing, drive-by downloads, and other threats encountered during routine work. Separate admin accounts significantly reduce the likelihood of privileged credential compromise through normal user activity
Recommended value
All administrators use dedicated admin accounts separate from their daily-use accounts. Admin accounts should not have mailboxes or productivity licenses assigned
Remediation
Review all privileged role members and identify accounts that also have productivity licenses (Exchange Online, SharePoint, Teams) assigned, indicating dual-use. Create dedicated admin accounts following a naming convention such as adm-username for each administrator. Assign privileged roles to the dedicated admin accounts only and remove privileged roles from daily-use accounts
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.7.2v1
- NIST SP 800-53
- AC-5, AC-6(2)
- CIS M365 Benchmark
- 1.1.1
- MITRE ATT&CK
- T1078.004