Admin portals are accessible only to administrative roles

Check ID: entra_admin_portals_access_restriction
Provider: Microsoft 365
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access restricts MicrosoftAdminPortals by targeting admin portals, including all users, excluding administrative roles, and applying a block decision. The assessment determines whether an active policy enforces this restriction rather than only reporting.

Risk

Absent this control, non-admin identities can reach admin portals, jeopardizing integrity (unauthorized tenant changes), confidentiality (exposure of settings and data), and availability (disabling services). Threats include privilege escalation, weakening policies, and creating persistence.

Recommendation

Enforce least privilege with Conditional Access that blocks MicrosoftAdminPortals for everyone except approved admin roles. Add defense in depth: require strong MFA/authentication strength, compliant devices, and trusted locations; use JIT via PIM. Review role assignments and policies routinely.

Remediation

CLI
Terraform
Dashboard steps

New-MgIdentityConditionalAccessPolicy -BodyParameter @{displayName="<example_resource_name>";state="enabled";conditions=@{users=@{includeUsers=@("All");excludeRoles=@("62e90394-69f5-4237-9190-012177145e10")};applications=@{includeApplications=@("MicrosoftAdminPortals")}};grantControls=@{builtInControls=@("block")}}

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: policy must be enabled to PASS

  conditions {
    users {
      include_users = ["All"] # Critical: include all users
      exclude_roles = ["62e90394-69f5-4237-9190-012177145e10"] # Critical: exclude admin role(s) so only admins can access
    }
    applications {
      included_applications = ["MicrosoftAdminPortals"] # Critical: target Microsoft Admin Portals
    }
  }

  grant_controls {
    built_in_controls = ["block"] # Critical: block non-excluded users
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_admin_portals_access_restriction. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Admin consent workflow is enabled All users with administrative roles are cloud-only accounts

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires