Azure Compliance ControlsAzure RBAC
Azure subscriptions should have a custom role for administering resource locks
Azure custom RBAC roles include the `Microsoft.Authorization/locks/*` action. This indicates permission to administer management locks at subscription, resource group, or resource scope. Prowler rates the check severity medium.
What this control checks
Azure subscriptions should have a custom role for administering resource locks
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Security in network and information systems acquisition, development and maintenance
- 6.24 Ensure that a custom role is assigned permissions for administering resource locks
- 5.24 Ensure that a custom role is assigned permissions for administering resource locks
- 6.2 Ensure that Resource Locks are set for Mission-Critical Azure Resources
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
6 more clauses
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body.
- 1.23 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 2.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_iam_custom_role_has_permissions_to_administer_resource_locks - Prowler Check:
iam_custom_role_has_permissions_to_administer_resource_locks
Last reviewed: 2026-10-11