Ensure that no person has permanent access to all Azure subscriptions at the root scope
MT.1056HighAzureAccess management
Part of Maester · Azure · Access management · All checks
Invoke-Maester -TestId MT.1056Overview
Section titled “Overview”Ensure that no person has permanent access to Azure Subscriptions.
User Access Administrator is a role that allows an Administrator to perform everything on an Azure Subscription. Global Administrators can gain this permission on the Root Scope in Entra ID, in the properties of the Entra ID tenant. These permissions should only be used in case of emergency and should not be assigned permanently.
Ensure that no User Access Administrator permissions at the Root Scope are applied.
Remediation action
Section titled “Remediation action”To remove all Admins with Root Scope permissions, as a Global Administrator:
- Navigate to Microsoft Azure Portal https://portal.azure.com.
- Search for Microsoft Entra ID and select Microsoft Entra ID.
- Expand the Manage menu and select Properties.
- On the Properties page, go to the Access management for Azure resources section.
- In the information bar, click Manage elevated access users.
- Select all User Access Administrators and click Remove.
- Also check other role assignments, as they need to be removed to pass the tests.
To remove the admins through CLI:
az role assignment delete --role "User Access Administrator" --assignee [email protected] --scope "/"Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1056 |
| Severity | High |
| Suite | Maester |
| Product | Azure |
| Related products | Entra ID |
| Feature | Access management |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1098.003 Additional Cloud Roles |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2 |
| PowerShell test | Test-MtUserAccessAdmin |
| Services | Azure, Graph |
Source
Section titled “Source”- Test:
tests/maester/azure/Test.MT.1056.ps1 - Documentation:
tests/maester/azure/Test.MT.1056.md