Over-provisioned administrator roles
Identifies users with broad roles (Global Admin, Exchange Admin) who should have more limited role assignments.
How to fix it
Apply the principle of least privilege. Use specific roles (e.g., User Admin instead of Global Admin) when broader permissions are not needed.
Required Microsoft Graph permissions
EntraAnalyzer needs the following read-only Graph permissions to evaluate this rule:
Directory.Read.AllRoleManagement.Read.Directory
Further reading
Run this check on your tenant
EntraAnalyzer evaluates this rule automatically on every scan and emails you the results.
Get started — free first scan →