Description:

This control verifies that privileged administrative roles within Microsoft 365 are assigned only to authorized personnel with a valid business requirement. Administrative privileges should be limited to approved users and granted according to the principle of least privilege.


Rationale:

Microsoft 365 administrative roles provide access to sensitive functions such as user management, security configuration, identity management, compliance settings, and data administration. Excessive administrative privileges increase the risk of unauthorized access, accidental changes, insider threats, and account compromise.

Restricting privileged access reduces the organization's attack surface and supports compliance with security best practices.


Impact:

Implementing this control may:

  • Reduce the number of users with administrative privileges.

  • Require role reviews and access approval processes.

  • Restrict access to administrative features for unauthorized users.

  • Improve accountability and security monitoring.

  • Enhance compliance with security and governance requirements.


Default Value:

Microsoft 365 does not automatically restrict privileged role assignments beyond tenant setup. Global Administrator and other privileged roles may be assigned to multiple users unless access governance controls are implemented.


Remediation:

Test Plan:

  1. Sign in to the Microsoft Entra Admin Center.

  2. Navigate to:

Identity → Roles & Administrators


  1. Review all users assigned privileged roles.

  2. Verify only authorized personnel have administrative assignments.

  3. Confirm inactive, terminated, guest, or unauthorized users do not hold privileged roles.

  4. Verify MFA is enabled for privileged accounts.

  5. If PIM is deployed:

    • Verify privileged roles require activation.

    • Verify activation approval workflows function correctly.

  6. Document findings and retain evidence of review.


Implementation:

Microsoft 365 / Microsoft Entra ID

  1. Sign in to the Microsoft Entra Admin Center.

  2. Navigate to:

Identity → Roles & Administrators


  1. Review privileged roles, including:

    • Global Administrator

    • Privileged Role Administrator

    • Security Administrator

    • Exchange Administrator

    • SharePoint Administrator

    • User Administrator

    • Authentication Administrator

    • Compliance Administrator

  2. For each privileged role:

    • Verify the assigned user requires administrative access.

    • Confirm documented business justification exists.

    • Remove unauthorized or inactive administrators.

  3. Apply the Principle of Least Privilege:

    • Assign only the minimum role required.

    • Avoid assigning Global Administrator unless absolutely necessary.

  4. Enable Multi-Factor Authentication (MFA) for all privileged accounts.

  5. If licensed, implement Microsoft Entra Privileged Identity Management (PIM):

    • Configure Just-In-Time (JIT) access.

    • Require approval for role activation.

    • Configure role activation notifications.

    • Enable access reviews.

  6. Periodically review privileged role assignments.


Backout Plan:

  1. Identify users whose administrative access was removed.

  2. Obtain management approval for access restoration.

  3. Reassign the required administrative role.

  4. Validate administrative functionality is restored.

  5. Monitor privileged activity following restoration.


References: