CISA.MS.AAD.7.6 - Activation of the Global Administrator role SHALL require approval.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Activation of the Global Administrator role SHALL require approval.

Rationale: Requiring approval for a user to activate Global Administrator, which provides unfettered access, makes it more challenging for an attacker to compromise the tenant with stolen credentials and it provides visibility of activities indicating a compromise is taking place.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.
2. Under Manage, select Microsoft Entra roles.
3. Under Manage, select Roles.
4. Select the Global Administrator role in the list.
5. Click Settings.
6. Click Edit.
7. Select the Require approval to activate option.
8. Click Update.
9. Review the list of groups that are actively assigned to the Global Administrator role. If any of the groups are enrolled in PIM for Groups, then also apply the same configurations under step 2 above to each PIM group's Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.6 Highly Privileged User Access - MS.AAD.7.6v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.7.6
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1548.005 Temporary Elevated Cloud Access
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.6
Criticality	SHALL
Upstream requirement	MS.AAD.7.6v1
Supports controls	cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1)
PowerShell test	Test-MtCisaRequireActivationApproval
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.7.6.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.7.6.md