#32370 Suspect | P1 | Azure: Entra ID Global Admin Role Assignment @ Artichoke Consulting - MSP Free

Created from Lead: https://artichoke.shield.syncromsp.com/leads/30472856/convert

[embedded image](https://www.blumira.com/)

Suspect | P1 | Azure: Entra ID Global Admin Role Assignment @ Artichoke Consulting - MSP Free

Blumira has detected Azure: Entra ID Global Admin Role Assignment for Artichoke Consulting - MSP Free on 2025-02-10 05:19PM MST and triggered action Create Priority 1 Suspect for Responders.

Analysis:

A Global Administrator Role has been assigned to the user or group [email protected] in your Entra ID Directory in the tenant 28657946-dbe0-492d-817f-ddba22c59fd6.

A Global Administrator has full permissions over the entire Azure tenant, similar to a Domain Administrator in on premise Active Directory. This role should be protected and access limited to as few individuals as possible to prevent abuse of these permissions.

Please note, this detection excludes assignments by Privileged Identity Management (PIM) and Granular delegated admin permissions (GDAP). If you would like to monitor PIM/GDAP assignments enable the detection "Azure: Entra ID Global Admin Role Assignment by PIM/GDAP" from the Detection Rules page under Settings.

Finding ID: F-25-06-4F2EE

Finding Data Source: Microsoft365 Azure AD, Azure AD Audit
Replying to this email does not open a ticket or notify the support team. Please email [email protected] or comment within the Finding.

[Learn More](https://app.blumira.com/6d44dca3-0d61-456b-9eef-18981f6fb2fc/query/findings/4f2ee48c-da89-4511-9cf0-0a80d3c8d668)

[embedded image]

[email protected]
[206 E. Huron Street, Suite 106, Ann Arbor, MI 48104](#)

8e7ebe1f-c255-436e-a0df-d0bdefa1442e

[embedded image]

Automation Blumira ran on this ticket. Actions: Change Status to New-Blumira