Overview 💥
Partners may observe an Actionable Alert triggered in Liongard indicating that a user or service account has been assigned the Places Administrator role.
This commonly raises concerns that:
A privileged administrator role was assigned unexpectedly
A security risk or privilege escalation occurred
Liongard incorrectly classified the role
Reference :
In most cases:
✅ Liongard behavior is expected
✅ The role assignment is valid
✅ The alert is informational rather than indicative of compromise
This article explains why the alert occurs and how the Places Administrator role should be interpreted.
What Is the Places Administrator Role? 🤔
The Places Administrator role is a Microsoft Entra built-in role designed to manage Microsoft Places / workplace location services, including:
Buildings
Rooms
Workspaces
Location metadata
Hybrid workplace configuration
This role supports Microsoft’s modern workplace and scheduling ecosystem.
Why Liongard Generates an Alert 🔔
Liongard’s Microsoft 365 Inspector monitors Microsoft Entra administrative role assignments through Microsoft Graph.
Alerts trigger when:
✅ A directory administrative role is assigned
✅ A new admin identity appears
✅ Role membership changes between inspections
Because Places Administrator is an administrative role, Liongard detects and reports the assignment change. This ensures visibility into all administrative access changes, not only security-critical ones.
Is Places Administrator a Privileged Role? ⚖️
No — Microsoft does NOT classify Places Administrator as a privileged role.
Microsoft defines privileged roles as those capable of:
Modifying credentials
Changing authentication policies
Elevating permissions
Accessing protected directory data
Examples include:
Global Administrator
Privileged Role Administrator
Authentication Administrator
Microsoft documentation defines privileged roles as those containing permissions that can modify authorization or credential controls. The Places Administrator role does not include these permissions.
Why the Alert Still Appears ✅
Liongard intentionally monitors all administrator role assignments, including service-specific roles. This design prevents situations where:
Newly introduced Microsoft roles go unnoticed
Service integrations silently gain admin permissions
Operational access expands without visibility
Therefore:
👉 The alert indicates role assignment activity, not necessarily elevated privilege risk.
Common Real-World Scenarios 🧑💻
The role is often assigned automatically when:
Microsoft Places features are enabled
Workspace booking or room management is configured
Third-party workplace integrations are deployed
Testing or pilot features are enabled by Microsoft
Administrators may not explicitly assign the role themselves.
Recommended Validation Steps 👨🔧
1️⃣ Verify Role Assignment
Navigate to: Microsoft Entra Admin Center
→ Roles & administrators
→ Places Administrator
→ Assignments
Confirm:
Assigned user or application
Assignment reason
Expected ownership
2️⃣ Review Account Type
Determine whether assignment belongs to:
✅ Human administrator
✅ Service principal
✅ Microsoft-managed application
Service identities are commonly expected.
3️⃣ Confirm Least Privilege Alignment
Validate that the assigned identity:
Requires location/workplace management access
Matches organizational governance policy
Security Impact Assessment 🛡️
Risk Area | Impact |
Directory privilege escalation | ❌ No |
Credential modification | ❌ No |
MFA policy changes | ❌ No |
Tenant-wide admin control | ❌ No |
Workplace/location management | ✅ Yes |
Result:
Low security risk — operational visibility alert.
Expected Behavior Summary 🤩
Capability | Behavior |
Role detected by Liongard | ✅ Expected |
Alert generated | ✅ Expected |
Privileged admin access | ❌ No |
Security incident indication | ❌ No |
Requires investigation | ⚠️ Verify only |
Root Cause 🌟
The alert occurs because:
Microsoft introduced the Places Administrator Entra role
Liongard monitors administrative role membership changes
The role is administrative but not privileged
Liongard correctly reports the assignment to maintain full administrative visibility.
Recommended Partner Action 🙋♂️
✅ Review assignment once
✅ Confirm legitimacy
✅ Suppress alert if operationally expected
No remediation is required unless the assignment is unauthorized.
Frequently Asked Question 🗣️
Why is Liongard alerting if the role is not privileged?
Liongard alerts on administrative role changes, not only privileged roles, to ensure partners maintain awareness of tenant access expansion.
Additional Notes 📝
Liongard aligns Microsoft 365 inspection behavior with Microsoft Entra role definitions exposed through supported Microsoft Graph APIs. Newly introduced Microsoft roles may generate alerts until partners validate operational intent.
Additional Resources 📚
‼️ Disclaimer
This article references third-party documentation published by Microsoft for informational purposes only. External documentation is owned and maintained by the respective vendor and may change without notice. Liongard does not control or guarantee the accuracy, availability, or future behavior of third-party APIs, features, or documentation referenced herein.