CISA.MS.AAD.7.4 - Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
Overview
Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
Rationale: Instead of giving users permanent assignments to privileged roles, provisioning access just in time lessens exposure if those accounts become compromised. In Azure AD PIM or an alternative PAM system, just in time access can be provisioned by assigning users to roles as eligible instead of perpetually active.
Note: Exceptions to this policy are:
- Emergency access accounts that need perpetual access to the tenant in the rare event of system degradation or other scenarios.
- Some types of service accounts that require a user account with privileged roles; since these accounts are used by software programs, they cannot perform role activation.
Remediation action
-
In Entra admin center select Show more and Roles & Admins and then All roles.
Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.
-
Select the Global Administrator role.
-
Under Manage, select Assignments and click the Active assignments tab.
-
Verify there are no users or groups with a value of Permanent in the End time column. If there are any, recreate those assignments to have an expiration date using Entra ID PIM or an alternative PAM system. If a group is identified and it is enrolled in PIM for Groups, see the exception cases below for details.
Related links
- Entra admin center - Roles and administrators | All roles
- CISA 7.4 Highly Privileged User Access - MS.AAD.7.4v1
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.7.4 |
| Severity | High |
| Suite | CISA |
| Product | Entra ID |
| Feature | Privileged Identity Management |
| Area | Privileged access |
| Resource type | DirectoryRole |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1098.003 Additional Cloud Roles |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.4 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.7.4v1 |
| Supports controls | cisa-scuba:MS.AAD.7.4, nist-800-53-r5:AC-2 |
| PowerShell test | Test-MtCisaPermanentRoleAssignment |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/cisa/entra/Test.CISA.MS.AAD.7.4.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.7.4.md