The Sleeper

First contact

Everyone was Global Administrator. The helpdesk. The people who answered the phone. The actual administrators too, obviously, but by then that had stopped being the point. “We have PIM,” they said, and they were right: P2 on every seat, paid annually, and not one eligible assignment anywhere in the tenant. They had bought the safest configuration Microsoft ships and never switched it on.

Behaviour

It does nothing at all, and that is the entirety of its danger. A permanent Global Administrator is not an event but a condition: fully armed every second of every day, whether its holder is working, on leave, or has stopped thinking about the tenant altogether.

Because it is a condition and not an action it leaves no trace of itself in use. Ask when a permanent administrator last exercised administrative rights and the assignment cannot answer. No record was ever created. It is the only creature in this collection that is invisible while doing exactly what it was designed to do.

Signs of infestation

For Global Administrator, Privileged Role Administrator and Security Administrator, count assignments in two piles: active and eligible. The target for the first pile is zero. Where the licence is P2 and the eligible pile is empty, PIM is present and dormant, which is the case worth finding first. Then put the assessor’s question to your current configuration — who elevated, when, why, and who approved it — and see whether an export answers it.

Containment

Convert the roles to eligible, require MFA and a justification at activation, put an approver on the highest, and bound the duration to the length of real work. Friction was never the point. An activation writes something down. A standing assignment never will.