Who Has Admin Rights in Your Entra ID Directory?

In most organisations the cloud directory that governs log‑ins, device enrolment and policy changes is a daily‑to‑day business concern. When that directory is Microsoft Entra ID, the people who hold administrator roles can open, modify or even delete critical resources. If the list of those administrators is out of date or excessively large, the risk of accidental or malicious change rises sharply. Regularly auditing who can do what in Entra ID is therefore a practical step to protect security, meet compliance obligations and keep IT operations predictable.

Why an Admin‑Rights Audit Matters

A recent diary entry on the SANS Internet Storm Centre highlighted two recurring findings: organisations often keep former auditors or contractors in privileged roles, and many teams simply grant too many people global administrator rights. Both situations inflate the attack surface, more accounts mean more chances for credentials to be stolen, and outdated accounts may linger unnoticed for years. The author links the problem to the Centre for Internet Security (CIS) Critical Controls, where controlling admin privileges is listed as a top priority.

Typical Symptoms of Poor Admin Management

• Stale privileged accounts, Users who left the company, completed a project or changed roles may still appear as Global Administrator or Global Reader.
• Over‑provisioned rights, Junior support staff are sometimes given rights that allow them to change Intune policies, create service principals or modify Azure AD settings, even though their day‑to‑day duties only require password resets.
• Mismatched expectations, IT managers often assume only a handful of people hold high‑level roles, yet a quick query can reveal dozens of accounts with similar privileges.

These symptoms are easy to miss without a systematic review because Entra ID does not surface a concise “admin list” on the standard portal view.

A Practical Way to Pull the Admin List

The SANS author shares a short PowerShell script that talks to Microsoft Graph, the API that exposes Azure and Entra information. The script performs three actions:

1. Connect to Microsoft Graph with the scopes Directory.Read.All and RoleManagement.Read.All.
2. Enumerate every activated directory role (for example Global Administrator, Privileged Role Administrator, etc.).
3. For each role, list the members and output the user’s display name, user principal name and the role they belong to.

Photo by cottonbro studio on Pexels

The core of the script looks like this:

Connect-MgGraph -Scopes "Directory.Read.All","RoleManagement.Read.All"
$roles = Get-MgDirectoryRole
foreach ($role in $roles) {
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
    foreach ($member in $members) {
        $user = Get-MgUser -UserId $member.Id
        Write-Output "Role: $($role.DisplayName) | User: $($user.DisplayName) | UPN: $($user.UserPrincipalName)"
    }
}

Running the script produces a flat list that can be imported into a spreadsheet for further analysis, for example counting how many people hold each role, flagging accounts that have not logged in for 90 days, or matching the list against HR records.

Caveats to Keep in Mind

• The script requires an account that already has the two Graph scopes; without them the query will fail.
• Some tenants use conditional access or custom roles that may not appear in the default Get-MgDirectoryRole call. Adjust the script accordingly if you see missing entries.
• The output is only as current as the moment you run the script; scheduled runs are recommended for ongoing compliance.

Turning the Data Into Action

1. Validate ownership, Cross‑reference the list with your HR or identity‑governance system. Remove or downgrade any account that no longer needs the privilege.
2. Apply the principle of least privilege, If a support technician only needs to reset passwords, assign the Password Administrator role rather than Global Administrator.
3. Document the baseline, Capture the approved list in a version‑controlled document. Any future addition should be justified and recorded.
4. Schedule regular reviews, Quarterly or bi‑annual audits align with most regulatory calendars and keep the admin surface area small.
5. Automate alerts, Use Azure AD entitlement management or a SIEM rule to flag newly created privileged accounts that do not match an approved template.

Photo by Vitaly Gariev on Pexels

Mapping to Industry Standards

The practice of auditing admin privileges maps directly to CIS Critical Controls version 7 control 4, "Control of Admin Privileges", and in version 8 it appears as control 6 under "Access Control Management". Aligning your audit cadence with these controls helps demonstrate due diligence during external assessments and can simplify audit reporting.

Quick Checklist

• [ ] Run the PowerShell‑Graph script and export the result.
• [ ] Identify accounts that have not logged in for more than 90 days.
• [ ] Verify each privileged account against current job roles.
• [ ] Reduce any over‑provisioned rights to the minimum required.
• [ ] Record the approved list and set a reminder for the next review.

Key Terms

• Entra ID, Microsoft’s cloud‑based identity and access management service, formerly known as Azure Active Directory.
• PowerShell, A command‑line shell and scripting language for Windows and cross‑platform automation.
• Microsoft Graph, The unified API endpoint that lets developers query Microsoft 365 and Azure services, including Entra ID.
• Global Administrator, The highest‑privilege role in Entra ID; holders can manage every aspect of the directory.
• Global Reader, A read‑only role that can view all settings but cannot make changes.
• CIS Critical Controls, A set of best‑practice security controls published by the Centre for Internet Security.

By treating the admin‑rights list as a living document rather than a one‑off task, organisations can keep their cloud directory tight, reduce the chance of accidental mis‑configuration and stay on the right side of compliance frameworks.

Regular admin-rights audits like this are part of the identity operations covered under managed IT services.