Ensure between two and four Global Administrators are designated

AltaNivel 1Automatizadam365

Descripción

At least two Global Administrators avoid lock-out; more than four widens the attack surface. Counts active members of the Global Administrator role. Requires an already-connected Microsoft Graph session: Install-Module Microsoft.Graph; Connect-MgGraph -Scopes Policy.Read.All,Directory.Read.All,RoleManagement.Read.Directory (read-only scopes). The audit throws if no session exists.

Cómo se verifica

Método de auditoría: Comando de shell

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-MgContext -ErrorAction SilentlyContinue) -or -not (Get-MgContext)) { throw 'Not connected: run Connect-MgGraph first' }; $r = Get-MgDirectoryRole -Filter "roleTemplateId eq '62e90394-69f5-4237-9190-012177145e10'" -ErrorAction Stop; if (-not $r) { throw 'Global Administrator role not found' }; $n = @(Get-MgDirectoryRoleMember -DirectoryRoleId $r.Id -All -ErrorAction Stop).Count; if ($n -ge 2 -and $n -le 4) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Microsoft 365 admin center > Roles > Global Administrator: keep 2-4 dedicated cloud-only admin accounts (including break-glass accounts); assign least-privileged roles to everyone else, preferably via PIM.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: m365identity
Referencia: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Microsoft 365 admin center / Global administrators count (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target m365