Description:
Verifies that tenant has the recommended number of Global Admins.
Why:
The Global Administrator role provides unfettered access to the tenant. Limiting the number of users with this level of access makes tenant compromise more challenging. Microsoft recommends fewer than five users in the Global Administrator role. However, additional user accounts, up to eight, may be necessary to support emergency access and some operational scenarios.
Configured: Tenant has the recommended number of Global Admins.
Not Configured: Tenant does not have the recommended number of Global Admins.
Scoring: Contributes up to 1 point to the Posture Recommendations score.
Category: Identity
Microsoft Licensing: Works with Basic licensing
Secure Score Impact: YES — Microsoft publishes the improvement action "Ensure that between two and four global admins are designated".
Remediation in Augmentt: No in-product remediation — remediate in the Microsoft admin portals.
Compliance Frameworks:
CISA SCuBA — MS.AAD.7.1
CIS Microsoft 365 Benchmark v6 (Level 1) — 1.1.3
CIS Microsoft 365 Benchmark v7 (Level 1) — 1.1.3
CMMC Level 2 — AC.L2-3.1.5
Microsoft documentation:
_KB status: new — this check is not yet documented in the knowledge base._
_Source: Sourced from the open-source Maester project and extended by Augmentt with multi-tenant support, compliance mapping and in-product remediation. Check ID CISA.MS.AAD.7.1 (module 1030)._
Sourced for this page:
Category — Maester test catalog (maester.dev/docs/tests) — test is graded against the "Entra ID Free" tier, so it evaluates a Microsoft Entra ID setting
Secure Score — Microsoft Learn publishes the Secure Score improvement action "Ensure that between two and four global admins are designated".
Draft metadata — apply these as Stonly tags in the console, then delete this block. The Stonly API cannot set tags, so they are recorded here instead.
Tags: posture-check · compliance-audit · Microsoft Entra ID · M365 Basic · CISA SCuBA · CIS M365 v6 L1 · CIS M365 v7 L1 · CMMC Level 2