MT.1029 - Stale accounts are not assigned to privileged roles.

Contributed by Thomas Naunheim with 4 co-contributorsAll contributors →

Overview

Stale accounts should not be assigned to privileged roles.

This test reads the Privileged Identity Management security alert Accounts in a privileged role have not signed in during the past n days (StaleSignInAlert) from Microsoft Graph and passes when the alert is not active or has no affected role assignments. Emergency access (break glass) accounts are excluded from the affected items.

Remediation action

1. In the Microsoft Entra admin center, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
2. Select the Accounts in a privileged role have not signed in during the past n days alert and follow its mitigation steps.

Related links

• Configure security alerts for Microsoft Entra roles in Privileged Identity Management - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1029
Severity	High
Suite	Maester
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-2(3), nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCheckMT1029
Services	Graph
Compatible licenses	AAD_PREMIUM_P2

Source

• Test: tests/maester/entra/Test.MT.1029.ps1
• Documentation: tests/maester/entra/Test.MT.1029.md