🛡️ Azure Subscription Dedicated Resource Lock Administrator Role is not assigned🟢⚪

• Contextual name: 🛡️ Dedicated Resource Lock Administrator Role is not assigned🟢⚪
• ID: /ce/ca/azure/subscription/resource-lock-administrator-dedicated-role
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A dedicated lock administrator can manage resource locks without the broader Owner or User Access Administrator role. Use the built-in Locks Contributor role or a custom role limited to managing resource locks.

Audit

Manual assessment is required. At every applicable subscription or resource-group scope, review inherited and direct assignments of Locks Contributor and qualifying custom roles. A custom role must grant Microsoft.Authorization/locks/* or both Microsoft.Authorization/locks/write and Microsoft.Authorization/locks/delete, with no broader administration rights. Check NotActions and assignment conditions as well as Actions. Confirm that appropriate designated administrators hold the role at the intended scope. Role existence alone does not establish assignment or organizational appropriateness.

References

1. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
2. https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access

Remediation

Open File

Remediation

Identify the designated resource-lock administrators and the narrowest subscription or resource-group scope they require. In Access control (IAM), assign Locks Contributor, or create and assign a custom role granting only Microsoft.Authorization/locks/* or both Microsoft.Authorization/locks/write and Microsoft.Authorization/locks/delete.

Review effective permissions, including inherited assignments, conditions and NotActions. Verify that administrators can manage the required locks without broader role-assignment permissions. Preserve existing locks; test with a noncritical resource and retain the previous role assignments for rollback. Do not remove existing access until the dedicated role has been verified.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 5.5 Ensure that a Dedicated Role is Assigned Permissions for Administering Resource Locks (Manual)			1		no data
💼 Cloudaware Framework → 💼 Role-Based Access Control (RBAC) Management			31		no data