Plan
active
Auditing Admin Rights in Microsoft Entra ID
- Engineer — Plan: Run an Entra ID privileged role audit this quarter: export current role assignments, flag stale accounts from departed staff, and scope down over-provisioned roles (e.g. helpdesk accounts holding Global Admin) to least-privilege equivalents.
- SOC/IR — Learn: Useful framing for why excessive Entra admin roles expand blast radius during identity-based intrusions, but no new TTPs, IOCs, or detection content here.
- Leader — Plan: Excess admin accounts are a recurring audit finding (CIS Control 4); scheduling a formal privileged-access review and documenting results strengthens posture for SOC 2 / ISO 27001 auditors asking exactly this question.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.