No service principals should be subscription owners

High Azure General subscriptionrolesecurity-service-principals-subscr

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when owners.hasServicePrincipals must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Reassign service principals from Owner to scoped roles to limit blast radius if compromised. In Azure Portal: Subscriptions > Access control (IAM) > reassign SPs. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices

Careful: Removing service principal owners may break automation pipelines and CI/CD

CLI

az role assignment list --role Owner --scope /subscriptions/{sub} --query "[?principalType=='ServicePrincipal']" -o table

Terraform

# Subscription-level RBAC - remove service principal Owner assignments
# data "azurerm_subscription" "current" {}
# Remove azurerm_role_assignment resources for service principals
# with role_definition_name = "Owner"
# Use least-privilege roles (Contributor, Reader) instead

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan