Custom RBAC roles should not be used

Audit built-in roles such as 'Owner, Contributor, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling.

Using custom roles is treated as an exception and requires a rigorous review and threat modeling.

What this control checks

Audits Microsoft.Authorization/roleDefinitions whose type equals CustomRole.

Common pitfalls

Effect defaults to Audit and allows only Audit or Disabled

The effect parameter has a defaultValue of Audit. The effect allows only Audit or Disabled.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit usage of custom RBAC roles" (a451c1ef-c6ca-483d-87ed-f49761e3ffb5); PowerPipe control azure_compliance.control.iam_no_custom_role.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-2(7) (Privileged User Accounts), AC-6 (Least Privilege) and 1 more clause.

NIST Cybersecurity Framework v2.0: Mapped to GV.RR-01 (Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is...).

FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-2(7) (Role-Based Schemes) and AC-6 (Least Privilege).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-2 Account Management
AC-2(7) Privileged User Accounts
AC-6: Least Privilege
AC-6(7) Review of User Privileges

NIST Cybersecurity Framework v2.0

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.

FedRAMP Moderate Baseline Rev 4

AC-2 (3): Disable Inactive Accounts
AC-2(7) Role-Based Schemes
AC-6 (5): Privileged Accounts

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.

RBI IT Framework for NBFCs

3.1.a Identification and Classification of Information Assets
3.1.f Maker-checker

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts

FedRAMP High

AC-2 Account Management
AC-2(7) Role-Based Schemes
AC-6 Least Privilege
AC-6(7) Review Of User Privileges

HIPAA HITRUST v9.2

1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems
1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures

PCI DSS v3.2.1

7.2.1 Confirm that access control systems are in place on all system components
Do not store sensitive authentication data after authorization (even if encrypted)
Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: iam_no_custom_role
Powerpipe Control: azure_compliance.control.iam_no_custom_role
Azure Policy Definition: a451c1ef-c6ca-483d-87ed-f49761e3ffb5

Last reviewed: 2026-10-13

View all Azure controls →