🛡️ Azure Role assignment delegation lacks conditional RBAC administration🟢⚪
- Contextual name: 🛡️ Role assignment delegation lacks conditional RBAC administration🟢⚪
- ID:
/ce/ca/azure/microsoft-entra-id/conditional-rbac-administrator-delegation - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Stats
not available
Description
Description
Role assignment management is delegated through User Access Administrator, or through Role Based Access Control Administrator with or without a role assignment condition that limits the roles and principals the delegate can assign. Root-scope assignments are covered by 'Ensure That Use of the 'User Access Administrator' Role is Restricted'. Prerequisites: Identify the roles and principal types each delegate assigns, including automation pipelines, so the condition does not block required assignments.
Rationale
User Access Administrator and an unconstrained Role Based Access Control Administrator let the holder assign any role, including Owner, to any principal at their scope, themselves included. A compromised or careless delegate can therefore take full control of every resource in that scope and hand assignment rights to others, with no limit short of removing the assignment.
Audit
This requirement needs manual assessment. The intended delegated administrators and approved condition boundaries require organizational review; role-name matching alone cannot establish correct delegation.
Remediation
Remediation
Role assignment management is delegated through User Access Administrator, or through Role Based Access Control Administrator with or without a role assignment condition that limits the roles and principals the delegate can assign. Root-scope assignments are covered by 'Ensure That Use of the 'User Access Administrator' Role is Restricted'. Prerequisites: Identify the roles and principal types each delegate assigns, including automation pipelines, so the condition does not block required assignments.
Assign Role Based Access Control Administrator at the required scope with a role assignment condition limiting the roles and principals the delegate may manage. Cover both assignment creation and removal in the condition. Remove broader assignments, including inherited assignments at their source scope, while retaining an independently authorized administrator who can recover access. Verify that the delegate can perform approved operations and is blocked from unapproved operations.
Automated assessment is unavailable: The intended delegated administrators and approved condition boundaries require organizational review; role-name matching alone cannot establish correct delegation.
policy.yaml
Linked Framework Sections
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|---|---|---|---|---|
| 💼 CIS Azure v7.0.0 → 💼 5.12 Ensure Role Assignment Management is Delegated with the 'Role Based Access Control Administrator' Role and Conditions (Automated) | 1 | no data | |||
| 💼 Cloudaware Framework → 💼 Role-Based Access Control (RBAC) Management | 31 | no data |