Subscription should not have excessive role assignments

Medium Azure General subscriptionrolesecurity-subscription-excessive-ro

Large numbers of role assignments increase complexity and may indicate over-permissioned access

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when totalAssignments must be less than 100. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Review and remove unnecessary role assignments to reduce the security surface. In Azure Portal: Subscriptions > Access control (IAM) > review role assignments. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices

CLI

az role assignment list --subscription "{sub}" --query "length(@)" -o tsv

Bicep

// Review and remove unnecessary role assignments to follow least-privilege principle
// Role assignments are managed via Microsoft.Authorization/roleAssignments resources

Terraform

# Review and remove unnecessary role assignments to follow least-privilege principle # Role assignments are managed via azurerm_role_assignment resources # data "azurerm_subscription" "current" {} # Use: az role assignment list --subscription <sub> --query "length(@)" # to identify and remove excess assignments

Compliance frameworks

Cloud Security BaselinePA-4

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan