Back to Checks
m365

PIM requires approval to activate the Global Administrator role

entra_pim_global_administrator_approval_required
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse5
Resource Type:NotDefined

Privileged Identity Management (PIM) should require approval to activate the Global Administrator role, with at least one approver configured. This adds a human authorization step before the most privileged role in the tenant can be used. Requires a Microsoft Entra ID P2 license.

Prowler logoProwlerprowler-provider-m365

Risk

Without approval to activate Global Administrator, an eligible or compromised account can self-activate the highest-privilege role without oversight, enabling immediate tenant-wide compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_pim_global_administrator_approval_required

Recommendation

Require approval to activate the Global Administrator role in PIM and configure at least one approver so activations are authorized before use.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **ID Governance** > **Privileged Identity Management** > **Microsoft Entra Roles** > **Roles**
3Select **Global Administrator** > **Role settings**
4Set **Require approval to activate** to **Yes** and add at least one approver
5Save the settings

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    GLOBAL_ADMINISTRATOR_ROLE_TEMPLATE_ID,
)


class entra_pim_global_administrator_approval_required(Check):
    """Check if PIM requires approval to activate the Global Administrator role.

    Privileged Identity Management (PIM) should require approval to activate the
    Global Administrator role, with at least one approver configured.

    - PASS: Approval is required to activate Global Administrator and approvers exist.
    - FAIL: Approval is not required or no approvers are configured.
    - No findings: PIM settings are unavailable.
    """

    def execute(self) -> List[CheckReportM365]:
        """Evaluate PIM approval settings for the Global Administrator role.

        Reports whether Privileged Identity Management requires approval to activate
        the Global Administrator role and whether at least one approver is configured.

        Returns:
            List[CheckReportM365]: A single report for the Global Administrator PIM
            role settings, or an empty list when the settings are absent.
        """
        findings = []
        setting = entra_client.pim_role_approval_settings.get(
            GLOBAL_ADMINISTRATOR_ROLE_TEMPLATE_ID
        )
        if not setting:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=setting,
            resource_name="Global Administrator PIM Role Settings",
            resource_id=GLOBAL_ADMINISTRATOR_ROLE_TEMPLATE_ID,
        )
        report.status = "FAIL"
        report.status_extended = (
            "PIM does not require approval to activate the Global Administrator role."
        )

        if setting.is_approval_required and not setting.has_approvers:
            report.status_extended = (
                "PIM requires approval to activate the Global Administrator role but "
                "no approvers are configured."
            )
        elif setting.is_approval_required and setting.has_approvers:
            report.status = "PASS"
            report.status_extended = (
                "PIM requires approval to activate the Global Administrator role and "
                "has approvers configured."
            )

        findings.append(report)
        return findings

References