AZ_GLOBAL_ADMIN

Summary

FSProtect ACL Alias	AZ_GLOBAL_ADMIN
Entra ID (Azure AD) Alias	Global Administrator
Affected Object Types	Microsoft Entra tenant (all directory objects and tenant-wide configuration)
Exploitation Certainty	Certain
Graph Permission / Role	Membership in the built-in Global Administrator directory role (direct assignment or via a role-assignable group). If Microsoft Entra PIM is used, eligibility and activations also apply

Description

AZ_GLOBAL_ADMIN represents the ability for a principal to operate as a Global Administrator in Microsoft Entra ID.

A Global Administrator has the highest level of administrative access in the tenant. A Global Administrator can:

• Assign and remove directory roles.

• Manage users, groups, devices, and tenant settings.

• Manage enterprise applications and app registrations, including credentials.

• Approve permissions and perform tenant-wide application management operations.

• Change security settings and access control configuration.

Therefore, any identity that holds the Global Administrator role can immediately perform tenant-wide privileged actions and can grant itself or others persistent administrative access.

Identification

PowerShell (Microsoft Graph)

List-GlobalAdmins.ps1

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

$globalAdminRoleDefinitionId = "62e90394-69f5-4237-9190-012177145e10"

$uri = "/v1.0/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$globalAdminRoleDefinitionId'&`$expand=principal"
$r = Invoke-MgGraphRequest -Method GET -Uri $uri

$r.value | ForEach-Object {
  $p = $_.principal
  [PSCustomObject]@{
    PrincipalType      = $p.'@odata.type'
    DisplayName        = $p.displayName
    UserPrincipalName  = $p.userPrincipalName
    AppId              = $p.appId
    ObjectId           = $_.principalId
    DirectoryScopeId   = $_.directoryScopeId
  }
} | Format-Table -AutoSize

Azure GUI

1

Open Roles & administrators

• Go to Microsoft Entra admin center → Roles & administrators.

2

Open Global Administrator

• Open Global Administrator.

3

Review Assignments

• Open Assignments and record:

  • Active assignments

  • Eligible assignments (if PIM is enabled)

4

Handle group assignments

• If a group is assigned:

  • Enumerate its transitive members (nested included).

5

Break-glass accounts

• Identify break-glass accounts and confirm they are protected and monitored.

Exploitation

A principal that holds the Global Administrator role can perform tenant-wide privileged actions immediately. This includes granting roles to other identities, changing authentication and access policy, and modifying application permissions and credentials.

Do not treat Global Administrator as an operational role for daily work. Treat it as emergency-only and tightly controlled administrative capability.

Mitigation

• Keep the number of Global Administrators as low as possible.

• Use Microsoft Entra PIM:

  • Prefer eligible assignments instead of permanent active assignments.

  • Require MFA and approvals for activation where appropriate.

• Use dedicated admin accounts and enforce strong authentication:

  • Phishing-resistant MFA where possible.

  • Conditional Access policies for privileged roles.

• Maintain controlled break-glass accounts:

  • Exclude only where necessary, and monitor continuously.

  • Store credentials securely and test access periodically.

• Review Global Administrator membership regularly and remove stale assignments.

Detection

Monitor Entra Audit logs for role changes and privileged activity.

• Alert on any changes that add or activate Global Administrator:

  • Role assignments created.

  • PIM activations for Global Administrator.

• Investigate:

  • Initiated by (actor)

  • Target resources

  • Source IP / device context if available

• Alert on abnormal privileged actions performed by Global Administrators:

  • New credentials added to applications.

  • New app role assignments to Microsoft Graph.

  • Changes to Conditional Access or authentication policies.

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/directory-roles-overview

• https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

• https://learn.microsoft.com/en-us/graph/api/resources/directoryrole?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/directoryrole-list-members?view=graph-rest-1.0

• https://learn.microsoft.com/en-us/graph/api/directoryrole-list?view=graph-rest-1.0&utm_source=chatgpt.com

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs