🛡️ Azure Privileged Role Assignments are not periodically reviewed🟢⚪

• Contextual name: 🛡️ Privileged Role Assignments are not periodically reviewed🟢⚪
• ID: /ce/ca/azure/subscription/privileged-role-assignments
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Description

Open File

Description

Perform periodic reviews of privileged role assignments to ensure that privileged roles assigned to users are accurate and appropriate.

Rationale

Privileged roles are crown jewel assets that can be used by malicious insiders, threat actors, and even through mistake to significantly damage an organization in numerous ways. These roles should be periodically reviewed to:

• identify lingering permission assignments, for example, an administrator has been terminated, the account is retained, but permissions are no longer necessary and have not been removed
• detect lateral movement through privilege escalation, for example, an account with administrative permission has been compromised and is elevating other accounts to bypass detection mechanisms

Impact

Increased administrative effort to manage and remove role assignments appropriately.

Audit

From Azure Portal

1. From Azure Home, select the Portal Menu.
2. Select Subscriptions.
3. Select a subscription.
4. Select Access control (IAM).
5. Look for the number under the word Privileged accompanied by a link titled View Assignments. Click the View assignments link.

... see more

Remediation

Open File

Remediation

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 5.3.4 Ensure that all 'privileged' role assignments are periodically reviewed (Manual)			1		no data
💼 Cloudaware Framework → 💼 Role-Based Access Control (RBAC) Management			18		no data