CISA.MS.AAD.7.7 - Eligible and Active highly privileged role assignments SHALL trigger an alert.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Eligible and Active highly privileged role assignments SHALL trigger an alert.

Rationale: Closely monitor assignment of the highest privileged roles for signs of compromise. Send assignment alerts to enable the security monitoring team to detect compromise attempts.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.

2. Under Manage, select Microsoft Entra roles.

3. Under Manage, select Roles.

   Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.

4. Click the Global Administrator role.

5. Click Settings and then click Edit.

6. Click the Notifications tab.

7. Under Send notifications when members are assigned as eligible to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.

8. Under Send notifications when members are assigned as active to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.

9. Click Update.

10. For each of the highly privileged roles, if they have any PIM groups actively assigned to them, then also apply the same configurations per the steps above to each PIM group's Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.7 Highly Privileged User Access - MS.AAD.7.7v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.7.7
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.7
Criticality	SHALL
Upstream requirement	MS.AAD.7.7v1
Supports controls	cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1)
PowerShell test	Test-MtCisaAssignmentNotification
Services	Graph
Compatible licenses	AAD_PREMIUM_P2, Entra_Identity_Governance

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.7.7.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.7.7.md