📝 Azure User Access Administrator Role has assignments 🟢

• Contextual name: 📝 Use of the 'User Access Administrator' role is not restricted 🟢
• ID: /ce/ca/azure/subscription/user-access-administrator-role
• Located in: 📁 Azure Subscription

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Authorization Role
  • 🔌 Azure Authorization Role - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant. Due to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks.

Rationale

The User Access Administrator role provides extensive access control privileges. Unnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.

Impact

Increased administrative effort to manage and remove role assignments appropriately.

Audit

This policy marks a User Access Administrator Azure Authorization Role as INCOMPLIANT if the role has any related Azure Authorization Role Assignments.

References

1. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
2. https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Subscriptions.
3. Select a subscription.
4. Select Access control (IAM).
5. Look for the following banner at the top of the page: Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access.
6. Click View role assignments.
7. Click Remove.

From Azure CLI

Run the following command:

az role assignment delete --role "User Access Administrator" --scope "/"

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v4.0.0 → 💼 6.3.3 Ensure that use of the 'User Access Administrator' role is restricted (Automated)			1
💼 Cloudaware Framework → 💼 Role-Based Access Control (RBAC) Management			13