CISA.MS.AAD.7.5: Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.

ID	CISA.MS.AAD.7.5
Severity	High
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Privileged Identity Management
Security area	Privileged access
Resource type	DirectoryRole
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.7.5 (SHALL)
Framework controls	cisa-scuba:MS.AAD.7.5 nist-800-53-r5:AC-2 Account Management
MITRE ATT&CK	T1098.003
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.

Rationale: Provisioning users to privileged roles within a PAM system enables enforcement of numerous privileged access policies and monitoring. If privileged users are assigned directly to roles in the M365 admin center or via PowerShell outside of the context of a PAM system, a significant set of critical security capabilities are bypassed.

Remediation action

1. In Entra admin center select Show more > Roles & admins and then select All roles.

   Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.

2. Select the Global Administrator role.

3. Under Manage, select Assignments and click the Active assignments tab.

4. For each user or group listed, examine the value in the Start time column. If it contains a value of -, this indicates the respective user/group was assigned to that role outside of Entra ID PIM. If the role was assigned outside of Entra ID PIM, delete the assignment and recreate it using Entra ID PIM.

Related links

• Entra admin center - Roles and administrators | All roles
• CISA 7.5 Highly Privileged User Access - MS.AAD.7.5v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne. Open-source licences.