Who Has Admin Rights in your Entra ID Directory?, (Wed, Aug 26th)

A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"&#;x26;#;x3f;&#;x26;#;xc2;&#;x26;#;xa0; Who can delete or change key things, or modify them in ways that might not be obvious (accidentally or on purpose).&#;x26;#;xc2;&#;x26;#;xa0; Yes, we trust our people, but if they&#;x26;#;39;ve moved on to other roles or to other organizations, they change from "our people" to "used to be our people".&#;x26;#;xc2;&#;x26;#;xa0;&#;x26;#;xc2;&#;x26;#;xa0;

Also, it&#;x26;#;39;s common to have too many admins.&#;x26;#;xc2;&#;x26;#;xa0; For instance, entry level support folks might need rights to change passwords, but they likely shouldn&#;x26;#;39;t have rights to change your intune policies or be global admins.&#;x26;#;xc2;&#;x26;#;xa0; The "too many admins" question is a common one that auditors will zero in on.&#;x26;#;xc2;&#;x26;#;xa0; This is #;4 on the CIS Critical Controls v7 as "Control of Admin Privileges".&#;x26;#;xc2;&#;x26;#;xa0; In version 8 of the list it&#;x26;#;39;s now at #;6 under "Access Control Management"&#;x26;#;xc2;&#;x26;#;xa0;