Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

User Added to Tier0 Role (non-PIM) [RULE-1140]

This rule detects when a user is added to a Tier0 role with very high privileges in a tenant where Privileged Identity Management (PIM) is not available. Tier0 roles include roles such as Global Administrator, Privileged Role Administrator, and Privileged Authentication Administrator, which grant near-complete control over the Microsoft 365 environment. PIM requires Entra ID P2 licensing, so in this tenant every role assignment is permanent and active from the moment it is made.

Rationale

Tier0 roles represent the highest level of privilege within a Microsoft Entra ID environment. These roles can manage all aspects of the tenant, including modifying security configurations, managing other administrators, and accessing all data. Because of their power, Tier0 role assignments are a high-value target for attackers.

Without PIM there is no just-in-time activation, no approval workflow, and no automatic expiry on these assignments. Every Tier0 role that is granted is standing access: the privileges are live continuously from the moment they are assigned until someone removes them. The set of accounts holding Tier0 roles is therefore the tenant's complete administrative attack surface at all times, which makes each individual assignment worth verifying.

An attacker who has compromised an account with sufficient privileges may elevate another account -- or their own -- to a Tier0 role to establish persistent control over the environment. This technique maps to MITRE ATT&CK T1098 (Account Manipulation) and T1078.004 (Valid Accounts: Cloud Accounts). Because there is no activation step that would surface the privilege later, detecting the assignment itself is the primary opportunity to catch this.

Follow-up

Follow these steps to adequately address this detection:

  1. Verify whether the Tier0 role assignment was intentionally performed by an authorized administrator. Confirm with the IT security team or the administrator listed in the alert whether this change was planned and approved.
    • If no: The role assignment was not authorized and may indicate a compromised account:
      1. Immediately remove the user from the Tier0 role via the Entra admin center under Identity > Roles & admins.
      2. Block sign-in for both the user who was assigned the role and the administrator account that performed the assignment, and revoke all active sessions.
      3. Investigate authentication methods and recent activity for both accounts to determine the scope of compromise.
      4. Contact the Attic IR team for a thorough investigation. An IR Credit Pack is required for this service.
    • If yes: The role assignment was intentionally performed:
      1. Confirm the account actually requires Tier0 privileges. A scoped role such as User Administrator or Exchange Administrator is often sufficient and considerably lower risk.
      2. Ensure the account is protected with phishing-resistant MFA and is covered by your administrator Conditional Access policies.
      3. Keep the number of accounts holding standing Tier0 roles to a minimum and review that list periodically. If just-in-time administrative access is a requirement for your organization, this needs Entra ID P2, which enables PIM.
      4. If the assignment is documented and in accordance with policy: close the incident.

More information