Who really holds Global Admin? Permanent vs eligible

Ask any admin who the Global Administrators are and you get names, usually two or three, said with confidence. Then ask which of them are apps. The question sounds like a joke until you look at the role schedules, where a pipeline or a sync connector sits next to the people, holding its role permanently.

These are field notes from asking the GraphPaaS connector for Claude about Fabrikam HQ, our demo tenant (synthetic people, real tool calls, data collected on 11 October at 03:07 UTC). Four numbers came back, and each one meant something other than what it first looked like.

Seven names, all of them people

The first answer is the one every admin list gives: who is a member of each directory role right now.

get_metrics(domain="governance", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"kind": "admin"}, columns=["role", "member_name", "member_upn"])
→ 7 rows

That list is built from directory role members, an older API that Microsoft itself now says to replace with the unified role management API. It answers "who has the role right now". It doesn't say how they got it, how long they keep it, or who could have it within five minutes. Here it has no apps in it at all, and nobody who is only eligible.

Fourteen rows once you ask the schedules

describe_domain(domain="pim", tenant_id="all")
→ available · 14 rows: 11 assignment, 3 eligible
get_metrics(domain="pim", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"permanent": true, "privileged": true}, group_by="principal_type")
→ User 6 · Service principal 3
get_metrics(domain="pim", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"role": "Global Administrator"}, group_by="kind")
→ assignment 2 · eligible 1

The pim domain reads two lists, the assignment and eligibility schedules. Between them they cover every way of holding a role: permanent or time-bound, active or eligible. "Eligible" means the person holds nothing until they activate. Microsoft's guidance in the same plan is short: keep zero permanently active assignments, except two cloud-only emergency access accounts that belong to no one in particular.

Against that, Fabrikam's two permanent Global Administrators are named people, not break-glass accounts. Inès, who can become Global Admin when she needs to and isn't one the rest of the time, is what the other two should look like. One more row shows PIM working: Hugo Keller holds User Administrator through an activation that ends at 09:07 UTC the same day. He shows up in the schedules and in no standing list.

Three admins nobody would call an admin

get_metrics(domain="pim", tenant_id="ce48e256-019f-4f8c-b951-0c52d1d65b8e",
            where={"principal_type": "Service principal"},
            columns=["role", "principal_name", "scope", "permanent", "created"])
→ 3 rows

This is the row that surprises people. None of these three would appear in a conversation about who the admins are, and the one with the most reach, Application Administrator, is a role Microsoft labels privileged: it can create and manage every app registration and enterprise app in the tenant. The same page puts "service principals or applications that hold highly privileged roles" in the control plane, to be protected like the admins themselves.

They are also harder to protect than the people. A workload identity can't perform multifactor authentication and keeps its secret stored somewhere. And PIM's usual fix doesn't apply: you can't make a service principal eligible for a role, only give it a time-limited active assignment. So the question for each app is narrower. Does the pipeline need to manage every app in the tenant, or only its own? Who owns the connector, and when did its secret last rotate? Our expiring app secrets article covers that second half.

Without P2, the question has no answer, and that's an answer

Eligibility is a PIM feature, and PIM needs Microsoft Entra ID P2 or ID Governance. A tenant without either has no schedules to read: Microsoft refuses the request outright instead of returning an empty list. The connector passes that on. On such a tenant, describe_domain reports pim as unavailable, with the licence as the reason, so Claude says it can't tell permanent from eligible. It never says "nobody has standing access", which is what an empty table would read as.

The licensing page has a second detail that matters more. If P2 or Governance lapses, permanent assignments stay, eligible assignments are removed, and active time-bound assignments become permanent. A tenant that lets the licence go doesn't lose its admins. It ends up with more standing access, and nobody granted it.