Azure subscriptions should not have blocked accounts with owner permissions
Checks whether an Azure subscription contains deprecated accounts that hold owner permissions. Deprecated accounts are accounts that have been blocked from signing in, and any of them with owner permissions should be removed from the subscription.
What this control checks
Blocked accounts with owner permissions on Azure resources should be removed.
Common pitfalls
Only AuditIfNotExists or Disabled effect
The policy effect defaults to AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Policy relies on a Security assessment
The policy looks for a Microsoft.Security/assessments entry named 050ac097-3dda-4d24-ab6d-82568e7a50cf. The existenceCondition passes when Microsoft.Security/assessments/status.code is NotApplicable or Healthy.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Blocked accounts with owner permissions on Azure resources should be removed" (0cfea604-3201-4e14-88fc-fae4c427a6c5); PowerPipe controls azure_compliance.control.ad_disabled_user_no_role_assignments, azure_compliance.control.iam_deprecated_account and azure_compliance.control.iam_deprecated_account_with_owner_roles.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management).
NIST Cybersecurity Framework v2.0: Mapped to GV.RR-01 (Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is...) and PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
NIST Cybersecurity Framework v2.0
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.a Identification and Classification of Information Assets
- 3.1.c Role based Access Control
- 3.1.f Maker-checker
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC-2 Account Management
- 1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems
- 8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
- 8.1.3: Immediately revoke access for any terminated users.
- 8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_deprecated_account_with_owner_roles - Powerpipe Controls:
azure_compliance.control.ad_disabled_user_no_role_assignments,azure_compliance.control.iam_deprecated_account,azure_compliance.control.iam_deprecated_account_with_owner_roles - Azure Policy Definition:
0cfea604-3201-4e14-88fc-fae4c427a6c5
Last reviewed: 2026-10-13