Limit Global Administrators to 2-4 for Financial Services & Banking

Financial Services & Banking organizations face specific regulatory requirements including soc2, pci-dss, nist-800-53, iso27001. The PA-01 control helps address these requirements by:

• Between 2 and 4 principals have the Global Administrator role
• No single point of failure (minimum 2)
• Attack surface is minimized (maximum 4)
• No service principals have Global Administrator (use least-privilege)
• No groups have Global Administrator (hidden privilege escalation risk)

Global Administrators have unrestricted access to your entire tenant. Too many increases your attack surface; too few risks lockout. Service principals and groups with Global Admin are especially dangerous - service principals can be compromised via app credentials, and groups hide who actually has the role. Microsoft recommends 2-4 permanent Global Admins for most organizations.

When implementing PA-01 in a financial services & banking environment, consider:

• **Regulatory requirements**: soc2, pci-dss, nist-800-53 may mandate specific configurations
• **Risk tolerance**: Financial Services & Banking organizations typically have moderate to low risk tolerance
• **Audit frequency**: Plan for regular compliance reviews
• **Documentation**: Maintain detailed records for regulatory inspections

To implement PA-01 in your Microsoft 365 environment:

• Between 2 and 4 principals have the Global Administrator role
• No single point of failure (minimum 2)
• Attack surface is minimized (maximum 4)
• No service principals have Global Administrator (use least-privilege)
• No groups have Global Administrator (hidden privilege escalation risk)

This control requires manual implementation through the Entra admin center.