You've got five Global Administrators in your Entra ID Directory. Is that five too many, or five too few? If you can't answer that question in the next 30 seconds, you're carrying unnecessary risk.
Administrative privilege sprawl isn't just a security problem. It's a compliance liability that shows up in every serious assessment. When your C3PAO reviews your CMMC Level 2 implementation of AC.L2-3.1.5 (least privilege) or your FedRAMP assessor examines AC-6 controls under NIST SP 800-53 Rev 5, they'll ask for your admin role inventory. If you can't produce it, or if it's full of outdated assignments, you've just signaled deeper control failures.
This checklist walks you through a complete Entra ID administrative rights audit. It's designed for quarterly execution, though higher-risk environments should run it monthly.
What This Checklist Covers
This audit focuses on Entra ID Directory roles, the permissions that control who can modify identity policies, change authentication requirements, access sensitive logs, and reconfigure your entire cloud identity infrastructure. You'll inventory current role assignments, validate business justification for each, and clean up the inevitable accumulation of orphaned privileges.
This isn't about application-specific roles or Azure resource permissions. Those require separate audits. We're addressing the foundational question: who can change the rules that govern everything else?
Prerequisites
Before you start, verify you have:
- PowerShell 7.x or later installed on your audit workstation
- Microsoft.Graph PowerShell SDK installed (
Install-Module Microsoft.Graph) - Directory.Read.All and RoleManagement.Read.All permissions assigned to your audit account
- Current organizational chart showing reporting relationships and role changes in the last 90 days
- Previous audit results (if this isn't your first run) for comparison
What "good" looks like: You can connect to Microsoft Graph, run Get-MgDirectoryRole, and receive output without permission errors. You have documentation showing who approved your audit permissions and when they expire.
Checklist Items
1. Generate Current Role Assignment Inventory
Connect to your Entra ID Directory and extract the complete list of administrative role assignments:
Connect-MgGraph -Scopes "Directory.Read.All", "RoleManagement.Read.All"
$adminslist = @()
$roles = Get-MgDirectoryRole
$adminslist = foreach ($role in $roles) {
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
foreach($m in $members) {
$adminuser = get-mguser -userid $m.id
[PSCustomObject]@{
RoleName = $role.DisplayName
UserAccount = $adminuser.userprincipalname
UserName = $adminuser.displayname
}
}
}
$adminslist | Export-Csv "EntraAdminAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
What "good" looks like: You have a timestamped CSV containing every user with any Entra ID administrative role, including role name, account identifier, and display name. No errors appear during extraction. The file is stored in your compliance evidence repository with restricted access.
2. Validate Each Global Administrator Assignment
Review every account with the Global Administrator role. This role has unrestricted access to every Entra ID setting and most Azure resources.
For each Global Administrator:
- Confirm current employment status
- Verify business justification documented within the last 12 months
- Check that the account uses phishing-resistant authentication (FIPS 140-2 validated authenticator or certificate-based authentication per AC-17(2))
- Validate that the account is used exclusively for administrative tasks (no email, no document access, no Teams usage)
What "good" looks like: You can explain why each Global Administrator needs that role. Each has documented approval from your CISO or equivalent authority. Each uses a dedicated admin account with conditional access policies requiring compliant devices and MFA. You have fewer than three Global Administrators per 1,000 users.
3. Review Privileged Role Administrator and Authentication Administrator Assignments
These roles can modify other administrators' permissions and authentication methods. They're common targets for privilege escalation attacks.
Verify:
- No overlap between people holding Privileged Role Administrator and those holding Global Administrator
- Authentication Administrators cannot modify credentials for privileged accounts
- All assignments follow separation of duties principles required by AC-5
What "good" looks like: No single individual can both create admin accounts and assign them privileged roles without a second approval. Your separation of duties matrix documents which roles are mutually exclusive.
4. Identify Dormant Administrative Accounts
Cross-reference your admin list against your HR system and recent sign-in logs.
Flag accounts where:
- The user left the organization more than 24 hours ago
- No sign-in activity appears in the last 90 days
- The user transferred to a role that doesn't require administrative access
- The account was created for a specific project that ended
What "good" looks like: Zero administrative accounts belong to former employees. Every admin account shows sign-in activity within your defined dormancy threshold (typically 90 days). You have a documented process for immediate role removal upon separation or role change, satisfying IA-4 and AC-2(3).
5. Audit Read-Only Administrative Roles
Review Global Reader, Directory Readers, and similar read-only roles. These often accumulate during audits, vendor assessments, and consulting engagements.
Check for:
- Auditor accounts from completed assessments
- Vendor accounts from finished projects
- Temporary accounts that were supposed to be deleted
- Consultant access that outlived the contract
What "good" looks like: Every read-only admin role has a documented business purpose and expiration date. External party access is governed by written agreements specifying maximum duration. You found that auditor from three years ago and removed them.
6. Validate Least Privilege for Helpdesk and Support Roles
Review Password Administrator, Helpdesk Administrator, and User Administrator assignments.
Confirm:
- Support staff cannot reset passwords for privileged accounts
- Helpdesk roles are assigned only to current support team members
- No support account has broader permissions than required for documented job functions
What "good" looks like: Your helpdesk can reset passwords for standard users but cannot touch admin accounts. Support roles align with your NIST SP 800-53 Rev 5 AC-6(5) implementation (privileged accounts on separate systems). Entry-level support staff don't hold User Administrator or higher.
7. Document Role Assignment Justifications
For every administrative role assignment, verify you have:
- Written approval from the resource owner or CISO
- Business justification explaining why this specific role is required
- Date of assignment and scheduled review date
- Evidence that the user completed role-specific security training
What "good" looks like: You maintain a role assignment register that satisfies AC-2(1) and AC-2(7). Each entry includes approver name, approval date, justification, and next review date. Missing or expired approvals trigger automatic removal.
8. Review Conditional Access Policies for Admin Accounts
Verify that all administrative accounts are subject to stronger authentication and access controls than standard users.
Check that policies enforce:
- Phishing-resistant MFA for all administrative access
- Compliant device requirements
- Restricted sign-in locations (if applicable to your threat model)
- Session time limits appropriate to role sensitivity
What "good" looks like: Your conditional access policies implement IA-2(1), IA-2(2), and IA-2(12). Admin accounts cannot authenticate from unmanaged devices. You can demonstrate that admin access requires both something you have and something you are (biometric) or a FIPS 140-2 validated hardware authenticator.
Common Mistakes
Treating admin audits as one-time events. Privilege creep is continuous. If you're not auditing quarterly at minimum, you're accumulating risk and compliance gaps. NIST SP 800-53 Rev 5 AC-2(7) requires periodic review of privileged accounts.
Assuming "just a few admins" means you're safe. The CIS Critical Controls places admin privilege management at #6 in version 8 under "Access Control Management" because it's a fundamental control regardless of organization size. Small teams often have worse admin hygiene because they skip formal processes.
Ignoring read-only roles. Global Reader can access sensitive configuration details, Audit Logging, and security settings. It's not "just" read access when it includes your entire security posture.
Running the audit but not acting on findings. Generating a report satisfies no compliance requirement. You must remediate findings, document decisions to accept risk, and prove you completed the remediation.
Using manual spreadsheets instead of automation. Manual tracking guarantees errors and makes quarterly audits painful enough that teams skip them. The PowerShell script above takes 90 seconds to run and produces audit-ready evidence.
Next Steps
After completing this checklist:
Remediate immediately: Remove access for terminated employees and expired vendor accounts today, not next week.
Schedule your next audit: Put the next quarterly review on your calendar before you forget. Assign a backup owner in case you're unavailable.
Update your System Security Plan: If you found violations of least privilege or separation of duties, document them as POA&M items with remediation timelines.
Automate the monitoring: Configure alerts for new Global Administrator assignments and weekly reports on admin role changes. Don't wait 90 days to discover a privilege escalation.
Review related controls: Admin rights audits connect to account management (AC-2), least privilege (AC-6), and separation of duties (AC-5). Use your findings to improve those broader control implementations.
Your admin list is either a compliance asset or a liability. The only way to know which is to look at it.
