03 · FindingsA finding that carries its own proof
Each finding names the object, the path that led to it and why it matters. It comes with a recommended action, which is raised as a ticket in your own workflow. Corinio suggests the change and a person approves it.
Finding · evidenceFindingPermanent privileged role, directly assigned High
ObjectAn administrator account
directory role · scope: tenant root
Pathidentity → directory role → tenant root
WhyThe role is active around the clock, including when the account is not administering anything. Compromise the account and the access is immediate.
ActionMake the role eligible with activation on demand. Raised as a ticket and approved by a person.
The structure of a real finding, with the object anonymised.