No guest users should have Owner role

Critical Azure General subscriptionrolesecurity-guest-users-owner-role

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when owners.hasGuests must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Remove guest users from the Owner role to prevent unauthorized changes by external identities. In Azure Portal: Subscriptions > Access control (IAM) > remove guest Owners. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

Careful: Verify guest users don't need Owner role for cross-tenant management scenarios

CLI

az role assignment list --role Owner --scope /subscriptions/{sub} --include-inherited --query "[?principalType=='Guest']" -o table

Terraform

# Subscription-level RBAC - remove guest Owner assignments
# data "azurerm_subscription" "current" {}
# Remove azurerm_role_assignment resources for guest principals
# with role_definition_name = "Owner"
# Verify guest users via: az role assignment list --role Owner

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan