Menu
Ensure 'Restrict access to Microsoft Entra admin center' is set to 'Yes'
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-5-17The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-foundations-5.17 |
| description | Ensure 'Restrict access to Microsoft Entra admin center' is set to 'Yes' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","admin-center","access-restriction","least-privilege"] |
| cis_id | 5.17 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.4","cis-azure-foundations-5.26"] |
| prerequisites | [] |
| severity_boost | {} |
Restrict access to the Microsoft Entra ID administration center to administrators only.
NOTE: This only affects access to the Entra ID administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Microsoft Entra ID.
The Microsoft Entra ID administrative center has sensitive data and permission settings. All non-administrators should be prohibited from accessing any Microsoft Entra ID data in the administration center to avoid exposure.
All administrative tasks will need to be done by Administrators, causing additional overhead in management of users and resources.
Microsoft Entra IDManage, select UsersManage, select User settingsAdministration centre, ensure that Restrict access to Microsoft Entra admin center is set to YesRestrict access to Microsoft Entra admin center should be set to Yes.
Microsoft Entra IDManage, select UsersManage, select User settingsAdministration centre, set Restrict access to Microsoft Entra admin center to YesSaveBy default, Restrict access to Microsoft Entra admin center is set to No.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | x | x | x |
| v8 | 6.8 Define and Maintain Role-Based Access Control | x | ||
| v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts | x | x | x |
Level 1 | Manual