Ensure multi-factor authentication is required for all Global Administrators
FailHighCIS Microsoft 365 Foundations · Control 55
Accounts holding the Global Administrator role can read and change every setting in the tenant, including the controls that protect every other account. A password alone is not an adequate control for that level of privilege: credential stuffing and adversary-in-the-middle phishing both defeat it, and a single compromised administrator is a full tenant compromise.
Current state: The directory holds 6 accounts with the Global Administrator role. 4 of them are not in scope of any enabled Conditional Access policy that requires multi-factor authentication: adm-jsmith@contoso.com, adm-mrossi@contoso.com, svc-directorysync@contoso.com and helpdesk-admin@contoso.com. One policy that would cover them, "CA004 — Require MFA for admins", exists but is in report-only state and therefore enforces nothing.
Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess','RoleManagement.Read.Directory'
# Role template IDs are constant across every Entra tenant.
$roles = @(
'62e90394-69f5-4237-9190-012177145e10' # Global Administrator
'194ae4cb-b126-40b2-bd5b-6091b380977d' # Security Administrator
'f28a1f50-f6e7-4571-818b-6a12f2af6b6c' # SharePoint Administrator
)
$params = @{
displayName = 'CA004 - Require MFA for privileged directory roles'
state = 'enabledForReportingButNotEnforced' # switch to 'enabled' after review
conditions = @{
users = @{
includeRoles = $roles
excludeUsers = @('<object-id-of-your-break-glass-account>')
}
applications = @{ includeApplications = @('All') }
clientAppTypes = @('all')
}
grantControls = @{
operator = 'OR'
builtInControls = @('mfa')
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params Review the report-only results in Entra sign-in logs for at least one working week, confirm that no service account is unexpectedly caught, then set state to enabled.