What this check looks at
Checks the PIM settings for Global Administrator and Privileged Role Administrator: activating either must need approval, from at least two approvers.
Privileged Identity Management (PIM), part of Microsoft Entra ID P2, lets administrators hold roles as eligible rather than permanently active: they activate a role when they need it, for a limited time. Each role’s PIM settings decide what activation requires, such as MFA, a justification, and approval by named approvers.
The check, for tenants with Entra ID P2, reads the PIM settings of Global Administrator and Privileged Role Administrator. It passes when activating either requires approval and at least two approvers are named. It fails, naming the role, when activation needs no approval, or when approval is on but fewer than two approvers are listed; each group added counts as one approver.
Without approval, an attacker who compromises an eligible administrator activates Global Administrator themselves and acts immediately. With approval, the request goes to someone else, who can refuse it, and the request itself is an alert. Two approvers mean one being on holiday never blocks a genuine activation.
Why it matters
With approval, an attacker who takes over an eligible administrator still cannot activate the role without someone else saying yes, and the request itself is the alert. Two approvers mean one being away never blocks a genuine activation.
An MSP engineer’s account, eligible for Global Administrator at several clients, is phished. With no approval, the attacker activates the role at each client in turn and creates backdoor accounts. With approval, each request lands with a second engineer who knows nobody asked for it, refuses it, and starts the incident response.
Approval adds a few minutes to genuine activations, which suits the two roles where the stakes are highest. For real emergencies, the break-glass accounts hold Global Administrator permanently and need no approval.
The CIS Microsoft 365 Foundations Benchmark (5.3.4 and 5.3.5) asks for approval to activate Global Administrator and Privileged Role Administrator, and the CISA SCuBA baseline (MS.AAD.7.6v1) asks for approval to activate Global Administrator. The rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Entra admin centre → Identity governance → Privileged Identity Management → Settings
Before you start
- Needs Entra ID P2 (PIM). Choose at least two approvers who will answer quickly; an approver cannot approve their own request.
Step by step
- Choose the approvers. Pick at least two people who will answer quickly and are not the usual requesters (an approver cannot approve their own request); for an MSP, a senior engineer and a team lead are typical. Name them individually, or as two separate groups, because each group counts as one approver.
- Open the Global Administrator settings. In the Microsoft Entra admin centre, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Settings, select Global Administrator, then Edit.
- Require approval with two approvers. On the Activation tab, tick Require approval to activate, choose Select approver(s) and add the two or more approvers. Keep MFA (or an authentication strength) and Require justification on activation ticked. Select Update.
- Repeat for Privileged Role Administrator. Go back to Settings, select Privileged Role Administrator, then Edit, and set the same approval and approvers on the Activation tab. Select Update.
- Check the emergency access accounts. Make sure the emergency access accounts hold Global Administrator as a permanent active assignment, not eligible, so they never wait for approval in an emergency.
- Tell administrators and approvers. Tell eligible administrators that activation now waits for approval, and tell approvers they will receive an email and can approve in PIM under Approve requests. Agree how quickly they should respond.
- Confirm. Activate Global Administrator with a test eligible account: the request should show as pending approval. Both roles’ settings should show approval required with two or more approvers. Re-run the assessment to confirm.
What users will notice
Activating Global Administrator or Privileged Role Administrator waits for an approver. Plan for out-of-hours emergencies with the break-glass accounts.
How to confirm it worked
PIM, Microsoft Entra roles, Settings: both roles show "Require approval to activate: Yes" with two or more approvers.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Account separation test: admin accounts used only for administration |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-2 Avoid standing access for accounts and permissions |
| Zero Trust | Identities |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege |
| CMMC Level 2 | AC.L2-3.1.5 Least Privilege |
| ISO 27001:2022 | A.8.2 Privileged access rightsA.5.18 Access rights |
| CISA SCuBA | MS.AAD.7.6v1 Global Administrator activation requires approval |
| CIS M365 | 5.3.4 Ensure approval is required for Global Administrator role activation5.3.5 Ensure approval is required for Privileged Role Administrator activation |
| CIS Controls v8.1 | 6.8 Define and maintain role-based access control (IG3) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure Microsoft Entra role settings in PIM (Microsoft Learn)