User activation of the Global Administrator role SHALL trigger an alert.

Why This Matters

When the Global Administrator role is activated, it grants full access to all Microsoft 365 services and settings. Without an alert triggering on this action, a security team may not detect unauthorized or accidental elevation of privileges in time to prevent a breach. This alert is critical for maintaining visibility into high-impact role activations.

What Aether365 Checks

Aether365 verifies that your Microsoft Entra ID audit logs are configured to generate an alert whenever a user activates the Global Administrator role. This check appears in the Aether365 dashboard under the Entra ID security checks.