Inventory every privileged role assignment and bring Global Administrators below five¶
Licence and role
Inventory and role changes: any Microsoft Entra ID edition. Eligible counts are only non-zero when PIM is in use (Entra ID P2 or ID Governance).
Why it matters¶
You cannot protect admin access you have not listed. Microsoft recommends fewer than five Global Administrator assignments (an alert card appears on the Entra Overview page at 5 or more) and fewer than 10 privileged role assignments, plus two cloud-only emergency access accounts that keep Global Administrator permanently. Microsoft Entra ID has more than 65 built-in roles, and the admin center marks the high-risk ones with a PRIVILEGED label (preview).
Steps¶
- Run the read-only check (PA01) or open Entra admin center > Roles & admins > All roles, add the Privileged column and filter on it. Export who holds each privileged role, active and eligible.
- For every Global Administrator, write down the tasks that person really does and find the least privileged role for each task (for example Exchange Administrator, User Administrator, Helpdesk Administrator). Keep the list in the tracker.
- Agree the target with the IT lead: fewer than five Global Administrator assignments in total, the two emergency access accounts included (so two named people at most), and fewer than 10 privileged role assignments in total.
- Add the replacement roles first, confirm each person can still do their work for a few days, then remove Global Administrator from them.
- Record the final list (role, person, reason, owner) and repeat the count every quarter in PA05.
Impact on users¶
Admins who lose Global Administrator may hit a missing permission on a task they rarely do. Plan a short fallback: they activate the role through PIM (PA02) or ask one of the remaining Global Administrators.
Rollback¶
Re-add the removed role to the person while you find the right least privileged role. Keep the change in the tracker so the role does not stay by accident.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.Governance, .Users, .DirectoryObjects, .Authentication).
Connect first:
Connect-MgGraph -Scopes RoleManagement.Read.Directory,RoleManagementPolicy.Read.Directory,AccessReview.Read.All,User.Read.All,Directory.Read.All
Role: Global Reader is normally enough. If a PIM read is denied, run it as Privileged Role Administrator: the script still only reads.
$roles = 'Global Administrator','Privileged Role Administrator','Privileged Authentication Administrator','Security Administrator','Conditional Access Administrator','Exchange Administrator','SharePoint Administrator','User Administrator','Authentication Administrator','Application Administrator','Cloud Application Administrator','Hybrid Identity Administrator','Intune Administrator'
foreach ($n in $roles) { $d = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq '$n'"; if ($d) { $a = @(Get-MgRoleManagementDirectoryRoleAssignment -All -Filter "roleDefinitionId eq '$($d.Id)'"); $e = @(Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -All -Filter "roleDefinitionId eq '$($d.Id)'"); "$n | active now: $($a.Count) | eligible: $($e.Count)" } }
"Target: Global Administrator active below 5 (including the two emergency accounts); privileged assignments below 10 in total."
How to verify¶
The PA01 output shows fewer than five Global Administrator assignments and the Entra Overview page shows no Global Administrator alert card. Every privileged assignment has a named owner and reason in the tracker.
Sources¶
- Best practices (Microsoft Learn)
- Privileged roles permissions (Microsoft Learn)
- Security emergency access (Microsoft Learn)
This control is in the Privileged Access and PIM Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script.