CISA.MS.AAD.7.7: Eligible and Active highly privileged role assignments SHALL trigger an alert.

ID	CISA.MS.AAD.7.7
Severity	Medium
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Privileged Identity Management
Security area	Privileged access
Resource type	DirectoryRole
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.7.7 (SHALL)
Framework controls	cisa-scuba:MS.AAD.7.7 nist-800-53-r5:AC-2(1) Account Management | Automated System Account Management
MITRE ATT&CK	T1098.003
Reads from	Microsoft Graph
Licence needed	AAD_PREMIUM_P2, Entra_Identity_Governance

What this checks and how to fix it

Eligible and Active highly privileged role assignments SHALL trigger an alert.

Rationale: Closely monitor assignment of the highest privileged roles for signs of compromise. Send assignment alerts to enable the security monitoring team to detect compromise attempts.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.

2. Under Manage, select Microsoft Entra roles.

3. Under Manage, select Roles.

   Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.

4. Click the Global Administrator role.

5. Click Settings and then click Edit.

6. Click the Notifications tab.

7. Under Send notifications when members are assigned as eligible to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.

8. Under Send notifications when members are assigned as active to this role, in the Role assignment alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.

9. Click Update.

10. For each of the highly privileged roles, if they have any PIM groups actively assigned to them, then also apply the same configurations per the steps above to each PIM group’s Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.7 Highly Privileged User Access - MS.AAD.7.7v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne, JeanPhilippeGeorge. Open-source licences.