An integration account holding System Administrator

Integration account holds a Microsoft system role.

A service account with System Administrator or System Customizer bypasses nearly every access check. A compromised key can read everything, rewrite security, and cover its tracks. Pentesters find this in the first fifteen minutes.

Query systemuser for rows where applicationid is not null, link through systemuserroles to role, and read the role names. Anything called System Administrator or System Customizer is the finding. Check custom roles in the same list too: the second most common version is a role copied from System Administrator years ago and never trimmed.

Replace the system role with a custom least-privilege role scoped to what the integration actually touches.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator
• A role-holding team with both people and service accounts in it