MT.1025: No external user with permanent role assignment on Control Plane.
| ID | MT.1025 |
| Severity | High |
| Suite | Mito |
| Product | Entra ID |
| Feature | Roles and administrators |
| Security area | Privileged access |
| Resource type | User |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accountsnist-800-53-r5:AC-2(7) Account Management | Privileged User Accounts |
| MITRE ATT&CK | T1078.004, T1199 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”GET /beta/roleManagement/directory/roleAssignments?$expand=principal
Remediation action
Section titled “Remediation action”Review the configuration described above.
Mito check. Author: Cloud-Architekt; contributors: f-bader, thomas-s-schmidt, nathanmcnulty. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.