Too Many Global Administrators Assigned

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.