rules/findings/azure/IAM/subscription-disabled-accounts-with-high-level-permissions.json
|
{
"provider": "Azure", "serviceType": "Subscription Identity", "serviceName": "Subscription", "displayName": "Ensure disabled user accounts do not have read, write, or owner permissions", "description": "Ensure that any roles granting read, write, or owner permissions are removed from disabled Azure user accounts.<br/><br/>While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Removing role assignments from disabled user accounts depends on the context and requirements of each organization and environment.", "rationale": "Disabled accounts should not retain access to resources, as this poses a security risk.<br/><br/>Removing role assignments mitigates potential unauthorized access and enforces the principle of least privilege.", "impact": "Ensure disabled accounts are not relied on for break glass or automated processes before removing roles to avoid service disruption.", "remediation": { "text": " ##### Remediate from Azure Portal 1. Go to Microsoft Entra ID. 2. Under Manage, click Users. 3. Click Add filter. 4. Click Account enabled. 5. Click the toggle switch to set the value to No. 6. Click Apply. 7. Click the Display name of a disabled user account with read, write, or owner roles assigned. 8. Click Azure role assignments. 9. Click the name of a read, write, or owner role. 10. Click Assignments. 11. Click Remove in the row for the disabled user account. 12. Click Yes. 13. Repeat steps 7-12 for disabled user accounts requiring remediation. ", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azaduser?view=azps-15.4.0", "https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azroleassignment?view=azps-15.4.0", "https://learn.microsoft.com/en-us/powershell/module/az.resources/remove-azroleassignment?view=azps-15.4.0" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "5.3.5", "profile": [ "Level 1" ] } ], "level": "high", "tags": [], "rule": { "path": "az_role_assignment", "subPath": null, "selectCondition": { }, "data": { "properties": { "effectiveUsers.*": null, "displayName": "roleName", "description": "roleDescription", "templateId": "templateId", "permissions": "permissions" }, "expandObject": "effectiveUsers" }, "query": [ { "filter": [ { "conditions": [ [ "accountEnabled", "eq", "False" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "userPrincipalName": "User Principal Name", "id": "Object Id", "roleName": "Role Assigned", "accountEnabled": "accountEnabled" } }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "userPrincipalName", "id", "roleName", "accountEnabled", "permissions" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "userPrincipalName": "User Principal Name", "id": "Object Id", "roleName": "Role Assigned", "accountEnabled": "accountEnabled" } }, "status": { "keyName": [ "userPrincipalName", "roleName" ], "message": "The user {userPrincipalName} account has the {roleName} role assigned but the account was found to be disabled", "defaultMessage": null }, "properties": { "resourceName": "userPrincipalName", "resourceId": "id", "resourceType": "EntraUser" }, "onlyStatus": false } }, "idSuffix": "azure_disabled_identities_with_high_permissions", "notes": [], "categories": [], "immutable_properties": [ "name", "id" ], "id": "" } |