rules/findings/azure/IAM/subscription-user-access-administrator-role-not-restricted.json
|
{
"provider": "Azure", "serviceType": "Subscription Identity", "serviceName": "Subscription", "displayName": "Ensure that use of the \u0027User Access Administrator\u0027 role is restricted", "description": "The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant.\u003Cbr/\u003E\u003Cbr/\u003EDue to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks.", "rationale": "The User Access Administrator role provides extensive access control privileges.\u003Cbr/\u003E\u003Cbr/\u003EUnnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.", "impact": "Increased administrative effort to manage and remove role assignments appropriately.", "remediation": { "text": "\n\t\t\t##### Remediate from Azure Portal \n\t\t\t1. From Azure Home select the Portal Menu. \n\t\t\t2. Select Subscriptions. \n\t\t\t3. Select a subscription. \n\t\t\t4. Select Access control (IAM). \n\t\t\t5. Look for the following banner at the top of the page: Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access. \n\t\t\t6. Click View role assignments. \n\t\t\t7. Click Remove.\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "6.0.0", "reference": "5.3.3", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "az_role_assignment", "subPath": null, "selectCondition": {}, "data": { "properties": { "effectiveUsers.*": null, "name": "roleName", "description": "roleDescription", "isBuiltIn": "isBuiltIn", "roleType": "roleType", "assignableScopes": "assignableScopes", "templateId": "templateId" }, "expandObject": "effectiveUsers" }, "query": [ { "filter": [ { "conditions": [ [ "templateId", "eq", "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9" ], [ "assignableScopes", "match", "/" ] ], "operator": "and" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "userPrincipalName": "userPrincipalName", "roleName": "Role", "roleDescription": "Role Description" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "userPrincipalName", "roleName", "roleDescription" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "userPrincipalName": "userPrincipalName", "roleName": "Role", "roleDescription": "Role Description" }, "expandObject": null }, "status": { "keyName": [ "userPrincipalName" ], "message": "Ensure that use of the \u0027User Access Administrator\u0027 role is restricted for {userPrincipalName}", "defaultMessage": null }, "properties": { "resourceName": "userPrincipalName", "resourceId": "id", "resourceType": "@odata.type" }, "onlyStatus": false } }, "idSuffix": "azure_user_administrator_role_not_restricted", "notes": [], "categories": [], "immutableProperties": [ "userPrincipalName", "id" ], "id": "" } |