MT.1030 - Eligible role assignments on Control Plane are in use by administrators.

Contributed by Thomas Naunheim with 4 co-contributorsAll contributors →

Overview

Eligible role assignments on the Control Plane should be in use by administrators.

This test reads the Privileged Identity Management security alert Administrators aren't using their privileged roles (RedundantAssignmentAlert) from Microsoft Graph and passes when the alert is not active or has no affected role assignments. Emergency access (break glass) accounts are excluded from the affected items. The alert is filtered to Control Plane roles (Enterprise Access Model tiering).

Remediation action

1. In the Microsoft Entra admin center, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
2. Select the Administrators aren't using their privileged roles alert and follow its mitigation steps.

Related links

• Configure security alerts for Microsoft Entra roles in Privileged Identity Management - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1030
Severity	High
Suite	Maester
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-6, nist-800-53-r5:AC-2(3)
PowerShell test	Test-MtCheckMT1030
Services	Graph
Compatible licenses	AAD_PREMIUM_P2

Source

• Test: tests/maester/entra/Test.MT.1030.ps1
• Documentation: tests/maester/entra/Test.MT.1030.md