What it decides

Rule
ENTRA-ROLE-001
Applies to
entra · privileged-role-summary
Default severity
medium
Basis
documented-limit

On what authority

Microsoft states it plainly: "As a best practice, Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization. Global Administrators essentially have unrestricted access, and it is in your best interest to keep the attack surface low." The same page records what the product does with the number: "If you have 5 or more privileged Global Administrator role assignments, a Global Administrators alert card is displayed on the Microsoft Entra Overview page." THE NUMBER IS MICROSOFT'S AND SO IS THE BOUNDARY. A threshold this engine chose would make a pass mean nothing, because a reader could not tell whether five was a finding or an opinion. Five is where Microsoft's own product starts telling the administrator the same thing.

What it needs to decide

  • global_administrators.assignments

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

A COUNT IS NOT A ROSTER. Four accounts that share one password, four accounts belonging to people who left, and four accounts protected by phishing-resistant multifactor authentication all count as four and all pass. This rule reads how many, and nothing about who, whether they are still used, or how they are protected.

  • THIS READS ACTIVE ASSIGNMENTS AND NOT ELIGIBLE ONES. Assignments held as eligible under Privileged Identity Management live on another surface, behind another licence, and are not counted here. A tenant using PIM as Microsoft recommends may show one assignment and be able to activate nine, and this rule will pass. The direction of the error is known: this count is a floor, never a ceiling.
  • Assignments to service principals are counted alongside those to people, because the role is the same and so is what it can do. The collector publishes both figures separately for a reader who wants to separate them; this rule does not.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.