Posture check · Entra ID and hybrid
Fewer than two Global Administrators (T1078.004)
Microsoft recommends at least two cloud-only Global Administrator accounts. With one, losing that account leaves the tenant without anyone who can administer it.
Why it matters
A single Global Administrator is a single point of failure. If that account is locked out or deleted, only a Microsoft support case can restore access.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- The directory attribute
accountEnabled - Group memberships
- 3 more GraphnAI analyses
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
Adding a Global Administrator grants access, so GraphnAI doesn't do it. Assign the role in the Microsoft Entra admin center.
How to fix it
Assign Global Administrator to a second cloud-only user in the Microsoft Entra admin center. Microsoft recommends two emergency access accounts.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.