What it decides

Rule
ENTRA-ROLE-002
Applies to
entra · privileged-role-summary
Default severity
high
Basis
documented-guidance

On what authority

The same sentence appears across Microsoft's identity documentation, from the best-practice page to the Privileged Identity Management deployment plan: "Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role... The accounts are limited to emergency or 'break glass' scenarios where normal accounts can't be used or all other administrators are accidentally locked out." Two is not a preference here; it is the smallest number at which the recommendation can be met at all. A tenant with one assignment cannot hold an emergency account that is not also its working administrator, so the account that recovers from the failure is the account the failure happened to.

What it needs to decide

  • global_administrators.assignments

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

TWO ASSIGNMENTS IS NOT AN EMERGENCY ACCESS ACCOUNT. This rule counts assignments and cannot read whether either is held for emergencies, whether anybody knows its credentials, whether it is excluded from the Conditional Access policy that would block it, or whether it has ever been tested. A tenant whose two Global Administrators are two people in the same building passes this rule and is not covered.

  • Eligible assignments under Privileged Identity Management are not counted, and this is the direction where that matters least: an eligible assignment that has to be elevated is not the account you reach for when elevating is what is broken. Microsoft's own guidance is that emergency access accounts are permanently assigned, which is what this counts.
  • A service principal assignment counts here. It is a real way back into a tenant and is deliberately not excluded, but it is not a person and cannot follow a break-glass procedure.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.