Microsoft Entra role with permanent eligible members

The presence of a Microsoft Entra role with permanent eligible members allows a threat actor to gain direct access to administrative privileges upon compromising an account, justifying the high severity rating due to increased risk of privilege escalation and persistence.

A threat actor who compromises an account with permanent eligibility in a Microsoft Entra environment can immediately gain administrative privileges, enabling them to escalate their access and persist in the environment through unauthorized access to sensitive permissions. This allows for reconnaissance of administrative scope and exploitation of credentials.

Cayosoft Guardian continuously monitors role assignments and eligibility settings within your Microsoft Entra environment, detecting roles with permanent eligible members and flagging the issue for administrators to review and adjust.

Cayosoft Guardian alerts administrators when it detects a role with permanent eligible members, enabling them to review and modify the settings to ensure only time-limited roles are used for administrators, thereby reducing the risk of privilege escalation and persistence.