Security & Threat Intelligence · 26.08.2026, 16:03 UTC
Who Has Admin Rights in your Entra ID Directory?, (Wed, Aug 26th)
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SANS Internet Storm Center ↗ |
| Veröffentlicht | 26.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"? Who can delete or change key things, or modify them in ways that might not be obvious (accidentally or on purpose). Yes, we trust our people, but if they've moved on to other roles or to other organizations, they change from "our people" to "used to be our people". Also, it's common to have too many admins. For instance, entry level support folks might need rights to change passwords, but they likely shouldn't have rights to change your intune policies or be global admins. The "too many admins" question is a common one that auditors will zero in on. This is #4 on the CIS Critical Controls v7 as "Control of Admin Privileges". In version 8 of the list it's now at #6 under "Access Control Management"
Let's dig into your Entra ID Directory, you might find some surprises in your admin list.
# first, as always connect to the directory Connect-MgGraph -Scopes "Directory.Read.All", "RoleManagement.Read.All"
# Get the list of activated directory roles and the count of members $roles = Get-MgDirectoryRole foreach ($role in $roles) { $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id [PSCustomObject]@{ RoleName = $role.DisplayName MemberCount = $members.Count } }
RoleName MemberCount -------- ----------- Privileged Authentication Administrator 0 Global Administrator 5 Password Administrator …