Skip to content
MitoMito Docs

CISA.MS.AAD.7.1: A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
ID CISA.MS.AAD.7.1
Severity High
Suite CISA SCuBA baselines
Product Entra ID
Feature Roles and administrators
Security area Privileged access
Resource type User
User impact of fixing Low
Effort to fix Medium
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.7.1 (SHALL)
Framework controls cisa-scuba:MS.AAD.7.1
nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts
MITRE ATT&CK T1098.003, T1078.004
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.

Rationale: The Global Administrator role provides unfettered access to the tenant (Azure and Microsoft 365). Limiting the number of users with this level of access makes tenant compromise more challenging. Microsoft recommends fewer than five users in the Global Administrator role. However, additional user accounts, up to eight, may be necessary to support emergency access and some operational scenarios.

Remediation action:

Section titled “Remediation action:”

When counting the number of users assigned to the Global Administrator role, count each user only once.

  1. In Entra under Roles & adminis and All roles, search for Global Administrator and click on it to go to the role and see who is assiged. Count users that are assigned directly to the role and users assigned via group membership.

    If you have Entra ID PIM, count both the Eligible assignments and Active assignments.

    If any of the groups assigned to Global Administrator are enrolled in PIM for Groups, also count the number of group members from the PIM for Groups portal Eligible assignments.

  2. Validate that there are a total of two to eight users assigned to the Global Administrator role.

Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt, michaelmsonne, oed-metzb. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.