MT.1032 - Limited number of Global Admins are assigned.

Contributed by Thomas Naunheim with 4 co-contributorsAll contributors →

Overview

A limited number of Global Administrators should be assigned.

This test reads the Privileged Identity Management security alert There are too many global administrators (TooManyGlobalAdminsAssignedToTenantAlert) from Microsoft Graph and passes when the alert is not active or has no affected role assignments. Emergency access (break glass) accounts are excluded from the affected items.

Remediation action

1. In the Microsoft Entra admin center, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
2. Select the There are too many global administrators alert and follow its mitigation steps.

Related links

• Configure security alerts for Microsoft Entra roles in Privileged Identity Management - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1032
Severity	High
Suite	Maester
Product	Entra ID
Feature	Privileged Identity Management
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles
Supports controls	nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCheckMT1032
Services	Graph
Compatible licenses	AAD_PREMIUM_P2

Source

• Test: tests/maester/entra/Test.MT.1032.ps1
• Documentation: tests/maester/entra/Test.MT.1032.md