MT.1029: Stale accounts are not assigned to privileged roles.

ID	MT.1029
Severity	High
Suite	Mito
Product	Entra ID
Feature	Privileged Identity Management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-2(3) Account Management | Disable Accounts nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2

What this checks and how to fix it

Stale accounts should not be assigned to privileged roles.

This test reads the Privileged Identity Management security alert Accounts in a privileged role have not signed in during the past n days (StaleSignInAlert) from Microsoft Graph and passes when the alert is not active or has no affected role assignments. Emergency access (break glass) accounts are excluded from the affected items.

Remediation action

1. In the Microsoft Entra admin center, browse to ID Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
2. Select the Accounts in a privileged role have not signed in during the past n days alert and follow its mitigation steps.

Related links

• Configure security alerts for Microsoft Entra roles in Privileged Identity Management - Microsoft Learn

---

Mito check. Author: Cloud-Architekt; contributors: f-bader, merill, thomas-s-schmidt, nathanmcnulty. Open-source licences.