Microsoft Entra ID Administrative Units are not being used

This finding is rated informational severity because it indicates that administrators have broad privilege scope, which can increase the risk of unauthorized access and lateral movement if an administrator's credentials are compromised. The lack of administrative units enables attackers to gain broad access to resources within the tenant.

When administrative units are not being used, an attacker who compromises an administrator's credentials gains broad privilege scope, allowing them to access more resources and potentially move laterally within the tenant. The attacker can also use the compromised credentials to perform actions that would otherwise be restricted by delegation boundaries.

Cayosoft Guardian detects Microsoft Entra ID Administrative Units are not being used by identifying tenants where administrative units are absent or not used for scoped administration. This allows administrators to take corrective action and limit the privilege scope of their accounts.

Cayosoft Guardian helps reduce the risk of Microsoft Entra ID Administrative Units are not being used by alerting administrators to create and use administrative units. This limits the privilege scope, reduces the blast radius, and establishes delegation boundaries, making it more difficult for attackers to move laterally within the tenant.