Skip to main content

📝 Azure Subscription Leaving Microsoft Entra ID Directory and Subscription Entering Microsoft Entra ID Directory is not set to Permit No One 🟢

  • Contextual name: 📝 Subscription Leaving Microsoft Entra ID Directory and Subscription Entering Microsoft Entra ID Directory is not set to Permit No One 🟢
  • ID: /ce/ca/azure/subscription/leaving-or-entering-entra-id-directory-permited-to-no-one
  • Located in: 📁 Azure Subscription

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Description​

Open File

Description​

Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.

Rationale​

Permissions to move subscriptions in and out of Microsoft Entra ID directory must only be given to appropriate administrative personnel. A subscription that is moved into an Microsoft Entra ID directory may be within a folder to which other users have elevated permissions. This prevents loss of data or unapproved changes of the objects within by potential bad actors.

Impact​

Subscriptions will need to have these settings turned off to be moved.

Audit​

From Azure Portal​
  1. From the Azure Portal Home select the portal menu.
  2. Select Subscriptions.
  3. In the Advanced options drop-down menu, select Manage Policies.
  4. Ensure Subscription leaving Microsoft Entra ID directory and Subscription entering Microsoft Entra ID directory are set to Permit no one.

Default Value​

By default Subscription leaving Microsoft Entra ID directory and Subscription entering Microsoft Entra ID directory are set to Allow everyone (default).

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From the Azure Portal Home select the portal menu.
  2. Select Subscriptions.
  3. In the Advanced options drop-down menu, select Manage Policies.
  4. Set Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant to Permit no one.
  5. Click Save changes.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 1.24 Ensure That 'Subscription leaving Microsoft Entra ID directory' and 'Subscription entering Microsoft Entra ID directory' Is Set To Permit No One - Level 2 (Manual)1
💼 CIS Azure v3.0.0 → 💼 2.25 Ensure That 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' Is Set To 'Permit no one' (Manual)1
💼 Cloudaware Framework → 💼 General Access Controls10