No more than 3 owners assigned to subscription

High Azure General subscriptionrolesecurity-more-than-owners-assigned

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when owners.count must be less than 4. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Limit Owner role assignments to reduce blast radius of compromised accounts. In Azure Portal: Subscriptions > Access control (IAM) > remove unnecessary Owners. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices

Careful: Removing owners may lock out administrators. Review each assignment before removing

CLI

az role assignment list --role Owner --scope /subscriptions/{sub} --output table

Terraform

# Subscription-level RBAC - manage via azurerm_role_assignment
# List current Owner assignments and remove excess:
# data "azurerm_subscription" "current" {}
# resource "azurerm_role_assignment" "owner" {
#   scope                = data.azurerm_subscription.current.id
#   role_definition_name = "Owner"
#   principal_id         = "<principal-id>"
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan