Check ID: iam_role_user_access_admin_restricted
Provider: Azure
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: microsoft.authorization/roleassignments

​
What this check verifies

Azure subscription role assignments granting User Access Administrator are identified to surface principals able to manage access (Azure RBAC) at that scope.

​
Risk

Persistent User Access Administrator enables assigning high-privilege roles and reading control-plane data, enabling privilege escalation and unauthorized access. Impact: confidentiality (data exposure), integrity (unauthorized changes), availability (service disruption).

​
Recommendation

Enforce least privilege:
  • Avoid standing User Access Administrator; use time-bound, approval-based elevation (PIM)
  • Scope access to only required subscriptions/resource groups
  • Require MFA and monitor role activity
  • Review regularly and remove unused grants

​
Remediation

az role assignment delete —assignee <principal_id_or_upn> —role “User Access Administrator” —scope “/subscriptions/<subscription_id>”

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_role_user_access_admin_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks