{
  "_comment": "CISA baseline checks: a fictional tenant (contoso.example) whose only Global Administrators are the two emergency access accounts. The pass case for PA-INV-04 (MS.AAD.7.1v1: two to eight; Learn: fewer than five). Every name and ID is invented.",
  "roleDefinitions": [
    {
      "id": "62e90394-69f5-4237-9190-012177145e10",
      "templateId": "62e90394-69f5-4237-9190-012177145e10",
      "displayName": "Global Administrator",
      "isBuiltIn": true
    }
  ],
  "roleAssignments": [
    {
      "id": "ra-ea01-ga",
      "principalId": "0e000000-0000-4000-8000-000000000001",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/"
    },
    {
      "id": "ra-ea02-ga",
      "principalId": "0e000000-0000-4000-8000-000000000002",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/"
    }
  ],
  "roleAssignmentScheduleInstances": [
    {
      "id": "rasi-ea01-ga",
      "principalId": "0e000000-0000-4000-8000-000000000001",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": null,
      "endDateTime": null,
      "assignmentType": "Assigned",
      "memberType": "Direct",
      "principal": {
        "@odata.type": "#microsoft.graph.user",
        "id": "0e000000-0000-4000-8000-000000000001",
        "displayName": "Emergency Access 01",
        "userPrincipalName": "ea01@contosoexample.onmicrosoft.com"
      }
    },
    {
      "id": "rasi-ea02-ga",
      "principalId": "0e000000-0000-4000-8000-000000000002",
      "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
      "directoryScopeId": "/",
      "startDateTime": "2026-07-01T00:00:00Z",
      "endDateTime": "2026-12-31T00:00:00Z",
      "assignmentType": "Assigned",
      "memberType": "Direct",
      "principal": {
        "@odata.type": "#microsoft.graph.user",
        "id": "0e000000-0000-4000-8000-000000000002",
        "displayName": "Emergency Access 02",
        "userPrincipalName": "ea02@contoso.example"
      }
    }
  ],
  "roleEligibilitySchedules": [],
  "groupMembers": {},
  "users": {},
  "conditionalAccessPolicies": [],
  "azure": {}
}
