Every serious Microsoft 365 audit checklist leads with identity, and within identity, privileged access is where the risk concentrates. A compromised Global Administrator is a compromised tenant. Yet privileged role sprawl — too many standing admins, stale accounts, roles nobody reviews — is one of the most common findings.
This post covers how to audit privileged roles in Entra ID, find the stale admins, and reduce standing access.
What privileged role sprawl looks like
It rarely looks like one obvious mistake. It looks like:
- Too many Global Administrators. Every standing GA is a high-value target, and the count usually exceeds what Microsoft and CISA recommend (between two and four).
- Standing assignments. Admins with permanent roles that never expire, rather than just-in-time elevation.
- Stale accounts. Role members who have left, changed roles, or never used the privilege.
- Roles you forgot. It is not only Global Administrator — Exchange, SharePoint, User, Application, and Conditional Access Administrator roles all grant meaningful power.
- No review cadence. Membership that is never re-examined.
Individually these look minor. Together they mean a lot of accounts that can change tenant-wide settings.
What the frameworks expect
CISA's SCUBA baseline calls for a small number of Global Administrators and for privileged access to be just-in-time rather than standing. EIDSCA covers the privileged-role configuration as part of the Entra ID baseline. Microsoft's own guidance is the same: least privilege, just-in-time, reviewed regularly.
So the audit checks are well defined:
- How many Global Administrators exist? (Target: two to four.)
- Are the assignments standing or eligible? (Prefer eligible/PIM over permanent.)
- Who is in each privileged role, and do they still need it?
- When was membership last reviewed?
How to audit it
By hand, you open each directory role in the Entra admin center and read its members — doable for a few roles, tedious for a dozen. Automated, you pull the role assignments and the membership for each privileged role and evaluate them against the checks, flagging role sprawl, standing access, and stale members. That is part of what a hosted audit does for the identity surface; see the EIDSCA coverage.
Moving to just-in-time
The fix for sprawl is not "remove some admins and hope." It is Privileged Identity Management: make roles eligible rather than permanent, require activation with approval and a time limit, and review assignments on a schedule. Standing Global Administrators shrink to the small set of break-glass accounts that genuinely need to be permanent — and those get extra protection.
Just-in-time access does two things at once: it reduces the number of accounts that can be abused at any moment, and it produces a record of when privileged access was used.
Make it recurring
Privileged membership drifts constantly. People change roles; privileges do not always follow. New admins are added during an incident and never removed. That is why role review belongs in a recurring audit, not a one-time cleanup.
The short version
Privileged role sprawl is a top finding in every framework because it is common and high-impact. Audit how many admins you have, whether the access is standing, and who still needs it. Then move to just-in-time and review on a cadence — because the admin list you clean up today will grow again.
Run an audit to see your privileged role assignments across Entra ID, scored against the identity frameworks.