# Privileged access is restricted to authorised admins only

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206796980495-privileged-access-is-restricted-to-authorised-admins-only
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Microsoft 365 (MS365)](https://support.icompaas.com/support/solutions/folders/f_1781206551953491)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control verifies that privileged administrative roles within Microsoft 365 are assigned only to authorized personnel with a valid business requirement. Administrative privileges should be limited to approved users and granted according to the principle of least privilege.

  

Rationale:

Microsoft 365 administrative roles provide access to sensitive functions such as user management, security configuration, identity management, compliance settings, and data administration. Excessive administrative privileges increase the risk of unauthorized access, accidental changes, insider threats, and account compromise.

Restricting privileged access reduces the organization's attack surface and supports compliance with security best practices.

  

Impact:

Implementing this control may:

-   Reduce the number of users with administrative privileges.
    
-   Require role reviews and access approval processes.
    
-   Restrict access to administrative features for unauthorized users.
    
-   Improve accountability and security monitoring.
    
-   Enhance compliance with security and governance requirements.
    

  

Default Value:

Microsoft 365 does not automatically restrict privileged role assignments beyond tenant setup. Global Administrator and other privileged roles may be assigned to multiple users unless access governance controls are implemented.

  

Remediation:

Test Plan:

1.  Sign in to the Microsoft Entra Admin Center.
    
2.  Navigate to:
    

Identity → Roles & Administrators

  

3.  Review all users assigned privileged roles.
    
4.  Verify only authorized personnel have administrative assignments.
    
5.  Confirm inactive, terminated, guest, or unauthorized users do not hold privileged roles.
    
6.  Verify MFA is enabled for privileged accounts.
    
7.  If PIM is deployed:
    

-   Verify privileged roles require activation.
    
-   Verify activation approval workflows function correctly.
    

9.  Document findings and retain evidence of review.
    

  

Implementation:

Microsoft 365 / Microsoft Entra ID

1.  Sign in to the Microsoft Entra Admin Center.
    
2.  Navigate to:
    

Identity → Roles & Administrators

  

3.  Review privileged roles, including:
    

-   Global Administrator
    
-   Privileged Role Administrator
    
-   Security Administrator
    
-   Exchange Administrator
    
-   SharePoint Administrator
    
-   User Administrator
    
-   Authentication Administrator
    
-   Compliance Administrator
    

5.  For each privileged role:
    

-   Verify the assigned user requires administrative access.
    
-   Confirm documented business justification exists.
    
-   Remove unauthorized or inactive administrators.
    

7.  Apply the Principle of Least Privilege:
    

-   Assign only the minimum role required.
    
-   Avoid assigning Global Administrator unless absolutely necessary.
    

9.  Enable Multi-Factor Authentication (MFA) for all privileged accounts.
    
10.  If licensed, implement Microsoft Entra Privileged Identity Management (PIM):
     

-   Configure Just-In-Time (JIT) access.
    
-   Require approval for role activation.
    
-   Configure role activation notifications.
    
-   Enable access reviews.
    

12.  Periodically review privileged role assignments.
     

  

Backout Plan:

1.  Identify users whose administrative access was removed.
    
2.  Obtain management approval for access restoration.
    
3.  Reassign the required administrative role.
    
4.  Validate administrative functionality is restored.
    
5.  Monitor privileged activity following restoration.
    

  

References:

-   [Microsoft Entra Role-Based Access Control Documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference?utm_source=chatgpt.com)
    
-   [Microsoft Entra Administrative Roles Documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal?utm_source=chatgpt.com)
    
-   [Microsoft Privileged Identity Management Documentation](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure?utm_source=chatgpt.com)
    
-   [Microsoft Security Best Practices for Administrative Accounts](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning?utm_source=chatgpt.com)
    
-   [NIST Principle of Least Privilege Guidance](https://csrc.nist.gov/glossary/term/least_privilege?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.