Ensure That Use of the 'User Access Administrator' Role is Restricted

CaoCấp 1Xem xét thủ côngazure

Mô tả

The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant. Due to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks. The User Access Administrator role provides extensive access control privileges. Unnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Audit from Azure Portal 1. From Azure Home select the Portal Menu. 2. Select Subscriptions. 3. Select a subscription. 4. Select Access control (IAM). 5. In the horizontal menu select Roles. 6. Search for User Access Administrator. 7. In the Details column select View. 8. In the horizontal menu select Assignments. 9. Audit the list for assignments. Audit from Azure CLI Run the following command: az role assignment list --role "User Access Administrator" --scope "/" Ensure that the command does not return any User Access Administrator role assignment information.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Remediate from Azure Portal 1. From Azure Home select the Portal Menu. 2. Select Subscriptions. 3. Select a subscription. 4. Select Access control (IAM). 5. Select Access control (IAM). 6. In the horizontal menu select Roles. 7. Search for User Access Administrator. 8. In the Details column select View. 9. In the horizontal menu select Assignments. 10. Select the user you wish to remove. 11. Select Remove. Remediate from Azure CLI Run the following command: az role assignment delete --role "User Access Administrator" --scope "/"

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: access-controlazurecloudiam
Tham chiếu: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 5.3.3 Ensure That Use of the 'User Access Administrator' Role is Restricted