MT.1112: Privileged user accounts should not remain enabled when the linked primary account is disabled.


ID	`MT.1112`
Severity	Medium
Suite	Mito
Product	Defender
Related products	Entra ID
Feature	Exposure Management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Low
Framework controls	`nist-800-53-r5:AC-2` Account Management
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Lifecycle	Preview

What this checks and how to fix it

Reviewing the enabled status of a privileged account when the linked user identity has been disabled is critical to prevent orphaned high‑risk access. If a normal work account is deactivated (for example, because the user left the organization) but the related privileged account remains enabled, an attacker or former employee could still use that privileged identity to access sensitive systems, change security settings, or exfiltrate data unnoticed. Regularly checking and aligning the status of privileged accounts with their primary identities helps enforce least privilege, reduces the attack surface, and ensures that privileges are revoked promptly when a user’s employment or role ends.

How to fix

Review the results from this check and verify whether it is legitimate for the privileged user account to remain enabled when the associated primary work account has been disabled.

Mito check. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).