What this check looks at
Checks the PIM settings of the highly privileged roles CISA lists: assigning them (eligible or active) and activating them must email a monitored address as well as the default recipients.
Each role’s settings in Privileged Identity Management include notifications: who is emailed when someone is assigned the role as eligible, when someone is assigned it as active, and when an eligible member activates it. By default the alerts go to the Global Administrators and Privileged Role Administrators, who in a small organisation may be the very people the alert is about, and who may not read them.
The check, for tenants with Entra ID P2, reads the PIM settings of eight highly privileged roles: Global Administrator, Privileged Role Administrator, User Administrator, SharePoint Administrator, Exchange Administrator, Hybrid Identity Administrator, Application Administrator and Cloud Application Administrator. For each, the two role assignment alerts (eligible and active) and the role activation alert must have an additional recipient. It fails when any Global Administrator alert lacks one, warns when only other roles do, and passes when all have one.
Assigning or activating Global Administrator is the moment an attacker gains control of the tenant. If the only notification goes to the administrators’ own inboxes, or to a mailbox nobody watches, it is found weeks later in an audit log, if at all.
Why it matters
Assigning or activating Global Administrator is the moment an attacker gains control. An email to a monitored mailbox each time turns it into an alert someone sees within minutes, rather than an entry found weeks later.
An attacker who has taken over a User Administrator account makes a dormant account eligible for Global Administrator, then activates it at 2am. With alerts going to a monitored security or ticketing address, the MSP sees both events within minutes and can remove the assignment and investigate. Without them, the first sign may be a ransom note.
Adding a recipient costs nothing and produces little mail: privileged role changes are rare in a small organisation, so each alert is worth reading.
The CISA SCuBA baseline (MS.AAD.7.7v1, MS.AAD.7.8v1 and MS.AAD.7.9v1) asks for alerts when highly privileged roles are assigned and when Global Administrator and the other highly privileged roles are activated. The rule maps to NIST CSF 2.0 DE.CM-03.
How to fix it
Where: Entra admin centre → Identity governance → Privileged Identity Management → Settings
Before you start
- Needs Entra ID P2 (PIM). Choose a monitored mailbox, such as the security team’s, that someone reads.
Step by step
- Choose the monitored address. Pick a mailbox someone reads promptly: the MSP’s security or ticketing address, or the client’s IT security mailbox. A distribution list that includes the on-call engineer works well.
- Open the first role’s notification settings. In the Microsoft Entra admin centre, go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Settings, select Global Administrator, select Edit and open the Notification tab.
- Add the recipient to the three alerts. Under Send notifications when members are assigned as eligible to this role, enter the address in Additional recipients on the Role assignment alert row. Do the same on the Role assignment alert row under Send notifications when members are assigned as active to this role, and on the Role activation alert row under Send notifications when eligible members activate this role. Select Update.
- Repeat for the other highly privileged roles. Repeat for Privileged Role Administrator, User Administrator, SharePoint Administrator, Exchange Administrator, Hybrid Identity Administrator, Application Administrator and Cloud Application Administrator. The evidence on this finding lists which role and alert pairs are missing.
- Make sure someone acts on the alerts. Set up a mail or ticketing rule so PIM alerts are flagged, and agree what the reader does: check the assignment or activation was expected and, if not, remove it and start incident response.
- Confirm. Make a test account eligible for one of the roles and check the alert reaches the monitored address, then remove the test assignment. Re-run the assessment to confirm the finding passes.
What users will notice
None for users. The monitored mailbox receives an email whenever a highly privileged role is assigned or activated.
How to confirm it worked
PIM, Microsoft Entra roles, Settings: for each highly privileged role, the Notification tab lists the mailbox under assignment and activation alerts.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.c Generating alertsB2.c Privileged user management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-2 Enable threat detection for identity and access managementPA-2 Avoid standing access for accounts and permissions |
| Zero Trust | IdentitiesVisibility, automation and orchestration |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| NIST SP 800-171 | 3.14.7 Identify unauthorised use of systems |
| CMMC Level 2 | SI.L2-3.14.7 Identify Unauthorized Use |
| ISO 27001:2022 | A.8.16 Monitoring activitiesA.8.2 Privileged access rights |
| CISA SCuBA | MS.AAD.7.7v1 Highly privileged role assignments trigger an alertMS.AAD.7.8v1 Global Administrator activation triggers an alertMS.AAD.7.9v1 Activation of other highly privileged roles triggers an alert |
| CIS Controls v8.1 | 13.1 Centralize security event alerting (IG2) |
| NIST CSF 2.0 | DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events |
| NCSC 10 Steps | Identity and access managementLogging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure security alerts and notifications in PIM (Microsoft Learn)