Azure subscriptions should not have guest accounts with owner permissions
External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access. The Azure Policy check is titled "Guest accounts with owner permissions on Azure resources should be removed".
External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access.
What this control checks
Guest accounts with owner permissions on Azure resources should be removed
Common pitfalls
Effect allows only AuditIfNotExists and Disabled
The effect parameter has a defaultValue of AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
existenceCondition needs NotApplicable or Healthy
The policy's existenceCondition checks that Microsoft.Security/assessments/status.code is in NotApplicable or Healthy.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Guest accounts with owner permissions on Azure resources should be removed" (339353f6-2387-4a45-abe4-7f529d121046); PowerPipe control azure_compliance.control.iam_external_user_with_owner_role.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-02 (Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk...) and PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
NIST Cybersecurity Framework v2.0
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.a Identification and Classification of Information Assets
- 3.1.c Role based Access Control
- 3.1.f Maker-checker
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC-2 Account Management
- 1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems
- 7.2.1 Confirm that access control systems are in place on all system components
- 8.1.2 Control addition, deletion, and modification of user IDs, credentials, and other identifier objects
- 8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use.
- Do not store sensitive authentication data after authorization (even if encrypted)
- Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_external_user_with_owner_role - Powerpipe Control:
azure_compliance.control.iam_external_user_with_owner_role - Azure Policy Definition:
339353f6-2387-4a45-abe4-7f529d121046
Last reviewed: 2026-10-13