Ensure 'Administrative accounts are separate, unassigned, and cloud-only'

MediumLevel 1Manual reviewpower-platform

Description

Administrative accounts are special privileged accounts that could have varying levels of access to data, users, and settings. Each system administrator should utilize two (2) separate accounts, an administrator account to perform administrative tasks and a separate account for daily activities such as checking email. Users should only sign in with system administrator account to perform administrative tasks in the environment. Users with the system administrator role automatically have access to records, system, and custom entities. Creating separate administrative accounts can reduce the risk of credential theft and other types of attacks.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Verify there are separate administrative accounts being utilized. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Select Users > Active users then sort by the User type column. 3. Verify that Administrators have a dedicated administrative and regular user account.

How it is fixed

Fix method: Guidance or infrastructure patch

Ensure each administrator has an administrative and regular user account. In the Microsoft 365 Admin Center: 1. Log in to https://admin.microsoft.com as a Global Administrator. 2. Go to Users and then Active users and select Add a user. 3. Fill out the appropriate fields for Name, user, domain, password etc. 4. When prompted to assign licenses select Create user without product license (not recommended), then click Next. 5. Under the Option settings choose Admin center access followed by the appropriate role then click Next. 6. Select Finish adding. Note: Take into account the proper and valid licensing requirements and attribute the security roles inside power platform with the least privilege approach.

Properties

Operating systems: Any
Tags: power-platformsaas
Reference: CIS Microsoft Dynamics 365 Power Platform Benchmark v1.0.1 - 1.3 Ensure 'Administrative accounts are separate, unassigned, and cloud-only'