CISA.MS.AAD.7.6: Activation of the Global Administrator role SHALL require approval.

ID	CISA.MS.AAD.7.6
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Privileged Identity Management
Security area	Privileged access
Resource type	DirectoryRole
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.7.6 (SHALL)
Framework controls	cisa-scuba:MS.AAD.7.6 nist-800-53-r5:AC-6(1) Least Privilege | Authorize Access to Security Functions
MITRE ATT&CK	T1098.003, T1548.005
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

Activation of the Global Administrator role SHALL require approval.

Rationale: Requiring approval for a user to activate Global Administrator, which provides unfettered access, makes it more challenging for an attacker to compromise the tenant with stolen credentials and it provides visibility of activities indicating a compromise is taking place.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.
2. Under Manage, select Microsoft Entra roles.
3. Under Manage, select Roles.
4. Select the Global Administrator role in the list.
5. Click Settings.
6. Click Edit.
7. Select the Require approval to activate option.
8. Click Update.
9. Review the list of groups that are actively assigned to the Global Administrator role. If any of the groups are enrolled in PIM for Groups, then also apply the same configurations under step 2 above to each PIM group’s Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.6 Highly Privileged User Access - MS.AAD.7.6v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: ThorNicolai, JeanPhilippeGeorge. Open-source licences.