CISA.MS.AAD.7.9: User activation of other highly privileged roles SHOULD trigger an alert.

ID	CISA.MS.AAD.7.9
Severity	Medium
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	Privileged Identity Management
Security area	Privileged access
Resource type	DirectoryRole
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.7.9 (SHOULD)
Framework controls	cisa-scuba:MS.AAD.7.9 nist-800-53-r5:AC-6(9) Least Privilege | Log Use of Privileged Functions
MITRE ATT&CK	T1098.003, T1136.003, T1548.005
Reads from	Microsoft Graph

What this checks and how to fix it

User activation of the Global Administrator role SHALL trigger an alert.

Rationale: Closely monitor activation of the Global Administrator role for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts.

User activation of other highly privileged roles SHOULD trigger an alert.

Rationale: Closely monitor activation of high-risk roles for signs of compromise. Send activation alerts to enable the security monitoring team to detect compromise attempts. In some environments, activating privileged roles can generate a significant number of alerts.

Remediation action:

1. In Entra admin center select Identity governance and Privileged Identity Management.

2. Under Manage, select Microsoft Entra roles.

3. Under Manage, select Roles.

4. Search and click the Global Administrator role.

   For each of the highly privileged roles (other than Global Administrator), follow the same steps but enter a security monitoring mailbox different from the one used to monitor Global Administrator activations.

5. Click Settings and then click Edit.

6. Click the Notifications tab.

7. Under Send notifications when eligible members activate this role, in the Role activation alert > Additional recipients textbox, enter the email address of the security monitoring mailbox configured to receive role activation alerts.

8. Click Update.

9. If the role has any PIM groups actively assigned to it, then also apply the same configurations per the steps above to each PIM group’s Member settings.

Related links

• Entra admin center - Privileged Identity Management | Microsoft Entra roles
• CISA 7.8 Highly Privileged User Access - MS.AAD.7.8v1
• CISA ScubaGear Rego Reference
• CISA 7.9 Highly Privileged User Access - MS.AAD.7.9v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne, JeanPhilippeGeorge. Open-source licences.