ENTRALOGIC
KF

22 checks · 18 evaluated · 4 not evaluated

B1Critical5 accounts

Global Administrators with permanent assignment

A permanent Global Administrator can change anything in the directory at any moment, including the audit configuration. Five of them means five accounts whose compromise is indistinguishable from a full tenant compromise.

Evidence

AccountAssignedAssignmentLast usedMFA
adm.jsandvik@vestholm.no14 Mar 2023Permanent18 Aug 2026Registered
adm.kfloen@vestholm.no02 Sep 2023Permanent09 Aug 2026Registered
adm.legacy@vestholm.no27 Jan 2022Permanent11 Feb 2026Not registered
adm.eborge@vestholm.se18 Nov 2024Permanent19 Aug 2026Registered
svc.entra-sync@vestholm.no14 Mar 2023Permanent20 Aug 2026Not applicable

How this was derived

roleDefinition = 'Global Administrator'
AND assignmentType = 'Assigned'
AND directoryScope = '/'
Role assignments read
61
Distinct privileged principals
24

If closed

+5 points5 permanent assignments become approval-bound0 people left with standing rights

Fix

Replace the permanent assignment with rights that exist only inside an approved order, for the task and the window that order describes.

requires write access

Related findings

B2B3

Sample report. Fictional group, fictional data.