EIDTNT-009: Administrative Unit Configuration

Plataforma
Entra ID / M365
Categoría
Entra ID Tenant Configuration
Severidad
Info
Pilar de Zero Trust
Governance (peso 1)
Fixtures de referencia
2
Cobertura de ramas
Observada: los fixtures prueban los veredictos que ejercitan
Procedencia
baseline

Qué comprueba

Administrative units provide delegated administrative scope by grouping users, groups, and devices into logical containers with specific administrators assigned to manage only those objects. Without administrative units, delegated administrators may have broader access than intended, or administrative boundaries may not align with organizational structure. Properly configured administrative units enforce least-privilege delegation and prevent administrative overreach.

Valor recomendado

Administrative units configured to align with organizational delegation model with restricted management administrative units used for sensitive objects

Remediación

Review existing administrative unit configuration in Entra ID > Roles and administrators > Administrative units. Evaluate whether the current structure aligns with your organizational delegation requirements and whether sensitive objects such as privileged accounts are protected by restricted management administrative units. Create or modify administrative units as needed to ensure administrators can only manage objects within their designated scope.

Veredictos probados con fixtures

Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.

Escenarios de veredicto de EIDTNT-009
EscenarioVeredicto esperado
cleanPASS
no-dataNot Assessed

Mapeos a marcos de referencia

NIST SP 800-53
AC-2