Back to Checks
azure

Global Administrator role has fewer than 5 members

entra_global_admin_in_less_than_five_users
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra Global Administrator assignments are evaluated by counting current role members per tenant and identifying when the number of assignees is 5 or more.

Prowler logoProwlerprowler-provider-azure

Risk

Having 5+ Global Administrators expands the privileged attack surface. Compromised credentials or tokens can enable tenant-wide changes, disable security controls, exfiltrate data, and create persistence, impacting confidentiality, integrity, and availability across Entra, Microsoft 365, and Azure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_global_admin_in_less_than_five_users

Recommendation

Limit the Global Administrator role to fewer than 5 users.

  • Apply least privilege; use narrower roles where possible
  • Use PIM for just-in-time, no standing access
  • Enforce MFA and dedicated admin accounts
  • Run access reviews regularly and keep cloud-only break-glass accounts for emergencies

Remediation

CLI

Remove-MgDirectoryRoleMember -DirectoryRoleId (Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'").Id -DirectoryObjectId '<example_user_id>'

Terraform

# Keep Global Administrator assignments below 5 by defining only required principals
data "azuread_directory_role" "global_admin" {
  display_name = "Global Administrator"
}

# Critical: This assignment grants GA to a specific principal; keep total GA assignments < 5
resource "azuread_directory_role_assignment" "ga_primary" {
  role_id             = data.azuread_directory_role.global_admin.id  # Assigns the Global Administrator role
  principal_object_id = "<example_resource_id>"                      # Required account (e.g., break-glass)
}

# Critical: Add only necessary GA assignments; remove extras to ensure count < 5
resource "azuread_directory_role_assignment" "ga_secondary" {
  role_id             = data.azuread_directory_role.global_admin.id  # Assigns the Global Administrator role
  principal_object_id = "<example_resource_id>"                      # Second required account
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Identity > Roles & admins > Global Administrator
3Select View assignments (or Assignments)
4Remove members until the total Global Administrator assignments are fewer than 5
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_global_admin_in_less_than_five_users(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, directory_roles in entra_client.directory_roles.items():
            if tenant_domain in entra_client.users_retrieval_errors:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = f"Tenant: {tenant_domain}"
                report.resource_name = tenant_domain
                report.resource_id = entra_client.tenant_ids[0]
                report.status = "MANUAL"
                report.status_extended = (
                    f"Cannot evaluate the number of global administrators for tenant {tenant_domain}: "
                    f"Microsoft Graph did not return the tenant's users "
                    f"({entra_client.users_retrieval_errors[tenant_domain]}). "
                    f"Retry the scan or review the tenant's global administrators manually."
                )
                findings.append(report)
                continue

            report = Check_Report_Azure(
                metadata=self.metadata(),
                resource=directory_roles.get("Global Administrator", {}),
            )
            report.status = "FAIL"
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = "Global Administrator"

            if "Global Administrator" in directory_roles:
                report.resource_id = getattr(
                    directory_roles["Global Administrator"],
                    "id",
                    "Global Administrator",
                )

                num_global_admins = len(
                    getattr(directory_roles["Global Administrator"], "members", [])
                )

                if num_global_admins < 5:
                    report.status = "PASS"
                    report.status_extended = (
                        f"There are {num_global_admins} global administrators."
                    )
                else:
                    report.status_extended = f"There are {num_global_admins} global administrators. It should be less than five."

                findings.append(report)

        return findings

References