Microsoft Entra IDOverview
This recommendation aims to balance security and operational efficiency by ensuring that a minimum of 2 and a maximum of 4 users are assigned the Global Administrator role in Microsoft Entra ID. Having at least two Global Administrators ensures redundancy while limiting the number to four reduces the risk of excessive privileged access.
Rationale
The Global Administrator role has extensive privileges across all services in Microsoft Entra ID. The Global Administrator role should never be used in daily activities; administrators should have a regular user account for daily activities and a separate account for administrative responsibilities. Limiting the number of Global Administrators helps mitigate the risk of unauthorized access, reduces the potential impact of human error, and aligns with the principle of least privilege to reduce the attack surface of an Azure tenant. Conversely, having at least two Global Administrators ensures that administrative functions can be performed without interruption in case of unavailability of a single admin.
Impact
Implementing this recommendation may require changes in administrative workflows or the redistribution of roles and responsibilities. Adequate training and awareness should be provided to all Global Administrators.
References
Remediation guidance
From Azure Portal
- Open Global Administrator | Assignments
- Remove the Global Administrator role for users who do not or no longer require the role.
- Assign Global Administrator role via PIM which can be activated when required.
- Assign more granular roles to users to conduct their duties.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra Tenants with too many global administrators
Connectors
Covered asset types
Expected check: eq []
{
EntraMultipleGlobalAdministrators {
...AssetFragment
}
}
