CISA.MS.AAD.7.8 - User activation of the Global Administrator role SHALL trigger an alert.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

User activation of the Global Administrator role SHALL trigger an alert.

Rationale: Closely monitor activation of the Global Administrator role for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts.

User activation of other highly privileged roles SHOULD trigger an alert.

Rationale: Closely monitor activation of high-risk roles for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts. In some environments, activating privileged roles can generate a significant number of alerts.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.

2. Under Manage, select Microsoft Entra roles.

3. Under Manage, select Roles.

4. Search and click the Global Administrator role.

   For each of the highly privileged roles (other than Global Administrator), follow the same steps but enter a security monitoring mailbox different from the one used to monitor Global Administrator activations.

5. Click Settings and then click Edit.

6. Click the Notifications tab.

7. Under Send notifications when eligible members activate this role, in the Role activation alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive role activation alerts.

8. Click Update.

9. If the role has any PIM groups actively assigned to it, then also apply the same configurations per the steps above to each PIM group's Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.8 Highly Privileged User Access - MS.AAD.7.8v1
• CISA ScubaGear Rego Reference
• CISA 7.9 Highly Privileged User Access - MS.AAD.7.9v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.7.8
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1548.005 Temporary Elevated Cloud Access
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.8
Criticality	SHALL
Upstream requirement	MS.AAD.7.8v1
Supports controls	cisa-scuba:MS.AAD.7.8, nist-800-53-r5:AC-6(9)
PowerShell test	Test-MtCheckCISAMSAAD78
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.7.8.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.7.8.md