Posture check · Entra ID and hybrid
Global Administrator activation doesn't need approval (T1078.004)
An account that is eligible for Global Administrator can activate the role in Privileged Identity Management without approval.
Why it matters
A compromised eligible account becomes Global Administrator on its own, with no second person involved.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID. It needs Microsoft Entra ID P2 or Microsoft Entra ID Governance: on a tenant without it, the check doesn't apply.
It reads:
- 3 more GraphnAI analyses
Why there's no automatic fix
GraphnAI doesn't change Privileged Identity Management settings yet.
How to fix it
In the Microsoft Entra admin center, open Privileged Identity Management, then Microsoft Entra roles, then Settings. Edit Global Administrator and turn on Require approval to activate. Choose approvers who aren't eligible for the role.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.