E8-ADMIN-01failML signal: 0
Evidence
{
"permanentGlobalAdminCount": 2,
"totalUsers": 6,
"ratio": 0.3333333333333333
}Global Administrator Count
What this checks
The number of permanent Global Administrator assignments, excluding break-glass accounts. E8 ML1 requires both an absolute limit (≤ 4) and a ratio limit (≤ 1 % of total users).
Remediation
- Audit current Global Admins in Entra ID > Roles and administrators > Global Administrator.
- Remove unnecessary assignments — Global Administrator is the most powerful role; most tasks can be done with scoped roles (Exchange Admin, SharePoint Admin, Intune Admin, etc.).
- Replace with scoped roles where possible: prefer the principle of least privilege and assign the minimum role needed for each administrator's duties.
- Enable PIM (Entra ID P2) and convert remaining permanent Global Admin assignments to eligible assignments that must be activated on demand (see E8-ADMIN-02).
- Keep two break-glass accounts with permanent Global Admin for emergency access — these are detected by name and excluded from the count automatically. Store credentials offline in a safe.
E8-ADMIN-02partialML signal: 1
Evidence
{
"eligibleAssignments": 1,
"permanentAssignments": 3
}PIM Eligible vs Permanent Assignments
What this checks
The ratio of eligible (just-in-time via PIM) to permanent role assignments across all directory roles. A pass requires zero permanent assignments (all eligible); partial means a mix; fail means no eligible assignments at all.
Remediation
- License requirement: Privileged Identity Management requires Entra ID P2 (or Microsoft 365 E5).
- In Entra ID > Identity Governance > Privileged Identity Management > Entra roles, open each role and convert permanent members to eligible.
- Configure activation settings per role: require MFA on activation, limit activation duration (e.g., 8 hours), require justification, and optionally require approval from another admin.
- Notify on activation — configure notification recipients so that privileged role activations are audited in real time.
- For break-glass accounts, retain permanent Global Admin as an emergency measure; all other Global Admin assignments should be eligible.
- Review eligible assignments quarterly and remove stale assignments for users who no longer need the role.
E8-ADMIN-03failML signal: 0
Evidence
{
"licensedGlobalAdminCount": 2
}Admin Separation of Duties
What this checks
Whether any non-break-glass Global Administrators also hold assigned Microsoft 365 licenses (e.g., Exchange Online, Teams). Admins with user licenses can exploit their privileged role on resources they also consume, violating separation of duties.
Remediation
- Dedicated admin accounts should be cloud-only accounts with no mailbox, no Teams license, and no Microsoft 365 application access. They are used exclusively for administration.
- Remove assigned licenses from all Global Administrator accounts that are not break-glass accounts: Entra ID > Users > [admin account] > Licenses — remove all product licenses.
- If an administrator also needs to use M365 services as a regular user, they should have two separate accounts: one admin account (no licenses) and one user account (licensed, no admin roles).
- Automate enforcement by creating a Conditional Access policy or a lifecycle workflow that blocks license assignment to accounts in the Global Administrator role.