What it decides

Rule
ENTRA-ROLE-003
Applies to
entra · privileged-role-summary
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft's recommendation names the origin of the account, not only its role: "two cloud-only emergency access accounts permanently assigned the Global Administrator role". The security-planning guidance gives the reason in the failure it describes -- an organisation whose administrators all authenticated through federation was locked out entirely when federation failed. An account synchronised from on-premises inherits the availability of the directory it came from and of whatever connects them. That is acceptable for daily administration and is the one property an emergency account cannot have, because the emergency this guidance is written for includes that connection being the thing that failed.

What it needs to decide

  • global_administrators.cloud_only
  • global_administrators.user_assignments

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

ONE CLOUD-ONLY ADMINISTRATOR IS NOT AN EMERGENCY ACCESS ACCOUNT. This reads where accounts originate and nothing else: not whether any of them is held for emergencies, not whether its credentials are recoverable during an outage, and not whether a Conditional Access policy would block it at the moment it is needed.

  • A principal whose onPremisesSyncEnabled property Graph did not return is counted as neither cloud-only nor synchronised. The collector publishes that third figure separately, and a tenant where it is large is a tenant where this rule is reading less than it appears to.
  • Service principals are excluded from these counts. A service principal has no on-premises origin to read, and counting it as cloud-only would let an automation account satisfy guidance written about a person signing in during an outage.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.