Azure Compliance ControlsAzure RBAC
Disabled user accounts should not have read, write, or owner permissions
Verifies that roles granting `read`, `write`, or `owner` permissions are removed from disabled Azure user accounts, so a disabled account holds no such role assignments. The assessment status for this control remains manual.
What this control checks
Disabled Azure user accounts must not have read, write, or owner permissions.
Framework mappings
The clauses this control is mapped to in each framework.
- 5.3.5 Ensure disabled user accounts do not have read, write, or owner permissions
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_disabled_user_no_role_assignments - Powerpipe Controls:
azure_compliance.control.ad_disabled_user_no_role_assignments,azure_compliance.control.iam_deprecated_account
Last reviewed: 2026-10-09