Azure Compliance ControlsAzure RBAC
Azure subscriptions should prohibit Custom Subscription Administrator roles
The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.
What this control checks
Fails custom roles that allow * in actions (owner-equivalent) within their assignable scopes.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-02
5 more clauses
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
- PR.AA-04
- PR.AA-05
- 6.23 Ensure that no custom subscription administrator roles exist
- 5.23 Ensure that no custom subscription administrator roles exist
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- 1.21 Ensure that no custom subscription owner roles are created
- 1.20 Ensure that no custom subscription owner roles are created
- 1.23 Ensure That No Custom Subscription Owner Roles Are Created
- 1.23 Ensure That No Custom Subscription Administrator Roles Exist
- 1.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 1.22 Ensure That No Custom Subscription Administrator Roles Exist
- 2.23 Ensure That No Custom Subscription Administrator Roles Exist
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
2 more clauses
- 164.308(a)(4)(ii)(C) Access establishment and modification
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_no_custom_subscription_owner_roles_created - Powerpipe Control:
azure_compliance.control.iam_no_custom_subscription_owner_roles_created - Prowler Check:
iam_subscription_roles_owner_custom_not_created
Last reviewed: 2026-10-13