Rules/ID-001.global-admin-count.psd1
|
@{ Id = 'ID-001' Title = 'Between two and four Global Administrators exist' Area = 'RoleAssignments' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark (limit Global Administrators)' 'https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices' ) Rationale = 'One Global Administrator is a lockout risk, many are an attack surface. Microsoft recommends two to four, with day-to-day work done in lesser roles.' Remediation = 'Reduce Global Administrator assignments to 2-4 accounts (including break-glass) and use scoped admin roles or PIM eligibility for everything else.' Test = { param($Snapshot) $globalAdmins = @($Snapshot.RoleAssignments.assignments | Where-Object { $_._tlRoleName -eq 'Global Administrator' }) $principals = @($globalAdmins | ForEach-Object { [string]$_.principalId } | Sort-Object -Unique) $names = @($globalAdmins | ForEach-Object { if ($_.PSObject.Properties['_tlPrincipalName'] -and $_._tlPrincipalName) { $_._tlPrincipalName } else { $_.principalId } } | Sort-Object -Unique) if ($principals.Count -ge 2 -and $principals.Count -le 4) { New-TLRuleResult -Status Pass -Evidence ("{0} Global Administrators: {1}" -f $principals.Count, ($names -join ', ')) } else { New-TLRuleResult -Status Fail -Evidence ("{0} Global Administrators (recommended: 2-4): {1}" -f $principals.Count, ($names -join ', ')) } } } |