Disabled user accounts should not have read, write, or owner permissions
Verifies that roles granting `read`, `write`, or `owner` permissions are removed from disabled Azure user accounts, so a disabled account holds no such role assignments. The assessment status for this control remains manual.
Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in.
What this control checks
Disabled Azure user accounts must not have read, write, or owner permissions.
Common pitfalls
Assessment status remains manual
While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Removing role assignments from disabled user accounts depends on the context and requirements of each organization and environment.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls azure_compliance.control.ad_disabled_user_no_role_assignments and azure_compliance.control.iam_deprecated_account.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.3.5 (Ensure disabled user accounts do not have read, write, or owner permissions).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.3.5 Ensure disabled user accounts do not have read, write, or owner permissions
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_disabled_user_no_role_assignments - Powerpipe Controls:
azure_compliance.control.ad_disabled_user_no_role_assignments,azure_compliance.control.iam_deprecated_account
Last reviewed: 2026-10-09