Azure PIM Alert: Too Many Global Administrator Accounts Assigned to Tenant

Alerts when Azure PIM reports an overabundance of Global Administrator role assignments in a tenant.

FreeUnreviewedSigmahighv1

azure-pim-alert-too-many-global-administrator-accounts-assigned-to-tenant-7bbc309f

title: "Azure PIM Alert: Too Many Global Administrator Accounts Assigned to Tenant"
id: bef6c8be-bdf2-4ed3-8ae2-f4c7b713b2f1
status: test
description: This rule flags Azure Privileged Identity Management (PIM) incidents where there are too many accounts assigned the Global Administrator role in a tenant. Attackers may exploit excessive global admin assignments to increase privileged access surfaces and improve persistence or privilege escalation opportunities. The detection relies on PIM risk event telemetry with a matching riskEventType value for the specific “too many Global Administrators” alert.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: tooManyGlobalAdminsAssignedToTenantAlertIncident
  condition: selection
falsepositives:
  - Investigate if threshold setting in PIM is too low.
level: high
license: DRL-1.1
related:
  - id: 7bbc309f-e2b1-4eb1-8369-131a367d67d3
    type: derived

What it detects

This rule flags Azure Privileged Identity Management (PIM) incidents where there are too many accounts assigned the Global Administrator role in a tenant. Attackers may exploit excessive global admin assignments to increase privileged access surfaces and improve persistence or privilege escalation opportunities. The detection relies on PIM risk event telemetry with a matching riskEventType value for the specific “too many Global Administrators” alert.

Known false positives

Investigate if threshold setting in PIM is too low.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.