Back to Checks
m365

Tenant has between two and four Global Administrators

admincenter_users_between_two_and_four_global_admins
Service: admincenterSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Count of users assigned the Global Administrator role in the Microsoft 365 tenant is between 2 and 4 (inclusive).

Prowler logoProwlerprowler-provider-m365

Risk

Having 1 Global Administrator jeopardizes availability if that account is unavailable or locked out. Having 5 expands the attack surface; one compromised admin can enable tenant-wide changes, data exfiltration, and privilege escalation, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks admincenter_users_between_two_and_four_global_admins

Recommendation

Maintain 2-4 standing Global Administrators (include two break-glass accounts). Apply least privilege using scoped roles and just-in-time elevation. Enforce MFA, run periodic access reviews, and implement separation of duties to limit standing privileged exposure.

Remediation

Terraform

# Assign the Global Administrator role to a specific principal (user or group)
# Critical: Looks up the built-in Global Administrator role
data "azuread_directory_role" "global_admin" {
  display_name = "Global Administrator"
}

# Critical: Creates the role assignment so the principal becomes a Global Administrator
# This helps reach the recommended 2-4 Global Administrators
resource "azuread_directory_role_assignment" "<example_resource_name>" {
  role_id             = data.azuread_directory_role.global_admin.object_id  # Critical: GA role ID
  principal_object_id = "<example_resource_id>"                             # Critical: target user/group object ID
}

Other

1Go to https://entra.microsoft.com and sign in as Privileged Role Administrator or Global Administrator
2Navigate to Entra ID > Roles & admins > Global Administrator
3Select Assignments
4To add: click Add assignments, select user(s), click Add; repeat until total Global Administrators is between 2 and 4
5To remove: select extra assignment(s), click Remove, confirm
6Verify the Assignments count shows between 2 and 4

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.admincenter.admincenter_client import (
    admincenter_client,
)


class admincenter_users_between_two_and_four_global_admins(Check):
    """Check if there are between two and four Global Administrators in Microsoft Admin Center.

    This check verifies that the number of users with the 'Global Administrator' role is
    between 2 and 4, inclusive. If there are fewer than two or more than four, the check fails.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for the number of Global Administrators.

        This method checks if the number of users with the 'Global Administrator' role
        is between two and four. If the condition is met, the check passes; otherwise, it fails.

        Returns:
            List[CheckReportM365]: A list containing the result of the check for the Global Administrators.
        """
        findings = []
        directory_roles = admincenter_client.directory_roles
        global_admin_role = directory_roles.get("Global Administrator", {})

        if global_admin_role:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_admin_role,
                resource_name=global_admin_role.name,
                resource_id=global_admin_role.id,
            )
            report.status = "FAIL"
            report.status_extended = (
                "There are not between two and four global administrators."
            )

            num_global_admins = len(getattr(global_admin_role, "members", []))
            if 1 < num_global_admins < 5:
                report.status = "PASS"
                report.status_extended = (
                    f"There are {num_global_admins} global administrators."
                )
            else:
                report.status_extended = f"There are {num_global_admins} global administrators. It should be more than one and less than five."

            findings.append(report)

        return findings

References