Microsoft Entra tenant with unsecure delegation of Global Admin role

This issue is rated low severity because an attacker would still need additional steps or context to exploit the vulnerability. However, having only one global administrator account increases the risk of malicious activities and makes detection more difficult.

An attacker who gains access to a single global administrator account in a Microsoft Entra tenant can use that account to perform unauthorized administrative actions, such as creating new users or modifying group memberships. This allows the attacker to persist and evade detection.

Cayosoft Guardian detects this issue by continuously monitoring the number of global administrator accounts in your Microsoft Entra tenant. When only one account is found, Guardian flags it as a security issue so administrators are aware of the potential threat.

Cayosoft Guardian helps reduce this risk by alerting administrators to review and adjust their global administrator accounts. This ensures that there are at least two accounts for redundancy and audit purposes, reducing the risk of unauthorized access to sensitive administrative functions.