User Access Administrator count should be limited

High Azure General subscriptionrolesecurity-user-access-administrator

User Access Administrators can grant access to others — this role should be tightly controlled

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when userAccessAdmins.count must be less than 4. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Limit User Access Administrator role assignments to reduce privilege escalation risk. In Azure Portal: Subscriptions > Access control (IAM) > review assignments. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices

Careful: User Access Administrator can grant any role. Removing assignments may lock out administrators

CLI

az role assignment list --role "User Access Administrator" --scope /subscriptions/{sub} --output table

Terraform

# Limit User Access Administrator assignments to reduce privilege escalation risk # data "azurerm_subscription" "current" {} # Remove excess azurerm_role_assignment resources with # role_definition_name = "User Access Administrator" # Keep only essential assignments for administrative needs

Compliance frameworks

Cloud Security BaselinePA-4

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan