MT.1031 - Privileged role on Control Plane are managed by PIM only.

Contributed by Thomas Naunheim with 4 co-contributorsAll contributors →

Overview

Privileged roles on the Control Plane should be managed by Privileged Identity Management (PIM) only.

This test reads the Privileged Identity Management security alert Roles are being assigned outside of Privileged Identity Management (RolesAssignedOutsidePimAlert) from Microsoft Graph and passes when the alert is not active or has no affected role assignments. Emergency access (break glass) accounts are excluded from the affected items. The alert is filtered to Control Plane roles (Enterprise Access Model tiering).

Remediation action

1. In the Microsoft Entra admin center, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
2. Select the Roles are being assigned outside of Privileged Identity Management alert and follow its mitigation steps.

Related links

• Configure security alerts for Microsoft Entra roles in Privileged Identity Management - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1031
Severity	High
Suite	Maester
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	DirectoryRole
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1098.003 Additional Cloud Roles
Supports controls	nist-800-53-r5:AC-2(7), nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCheckMT1031
Services	Graph
Compatible licenses	AAD_PREMIUM_P2

Source

• Test: tests/maester/entra/Test.MT.1031.ps1
• Documentation: tests/maester/entra/Test.MT.1031.md