Microsoft Entra ID tenants should limit Global Administrators to fewer than 5
Microsoft Entra Global Administrator assignments are evaluated by counting current role members per tenant. The check identifies when the number of assignees is `5` or more. Prowler rates the check severity high.
Having 5+ Global Administrators expands the privileged attack surface. Compromised credentials or tokens can enable tenant-wide changes, disable security controls, exfiltrate data, and create persistence, impacting confidentiality, integrity, and availability across Entra, Microsoft 365, and Azure.
What this control checks
The Global Administrator role has fewer than 5 members
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_global_admin_in_less_than_five_users (prowler azure --checks entra_global_admin_in_less_than_five_users).
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control).
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.3.2.b (set up specific accounts to be used for system administration operations exclusively, such as installation...), 11.3.2.c (individualise and restrict system administration privileges to the highest extent possible,) and 6 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.26 Ensure fewer than 5 users have global administrator assignment
- 5.26 Ensure fewer than 5 users have global administrator assignment
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- 1.25 Ensure fewer than 5 users have global administrator assignment
- 2.26 Ensure fewer than 5 users have global administrator assignment
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
- 164.308(a)(4)(ii)(C) Access establishment and modification
Related controls
- Disabled user accounts should not have read, write, or owner permissions
- Non-privileged Microsoft Entra ID users should have multifactor authentication enabled
- Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
- Virtual machines should use just-in-time network access control for management ports
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_entra_global_admin_in_less_than_five_users - Prowler Check:
entra_global_admin_in_less_than_five_users
Last reviewed: 2026-10-11