Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5
Microsoft Entra Global Administrator assignments are evaluated by counting current role members per tenant. The check identifies when the number of assignees is `5` or more. Prowler rates the check severity high.
What this control checks
The Global Administrator role has fewer than 5 members
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.26 Ensure fewer than 5 users have global administrator assignment
- 5.26 Ensure fewer than 5 users have global administrator assignment
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.25 Ensure fewer than 5 users have global administrator assignment
- 2.26 Ensure fewer than 5 users have global administrator assignment
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
- Disabled user accounts should not have read, write, or owner permissions
- Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
- Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
- Virtual machines should use just-in-time network access control for management ports
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_global_admin_in_less_than_five_users - Prowler Check:
entra_global_admin_in_less_than_five_users
Last reviewed: 2026-10-11