Azure subscriptions should prohibit Custom Subscription Administrator roles
Prowler check iam_subscription_roles_owner_custom_not_created analyzes Azure custom roles for wildcard permissions.
Wildcard access grants full administrative control at subscription scope. If abused or compromised, an actor can exfiltrate data, alter configurations, deploy malware, delete resources, and disable logging, impacting confidentiality, integrity, and availability across the subscription.
What this control checks
Fails custom roles that allow * in actions (owner-equivalent) within their assignable scopes.
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_subscription_roles_owner_custom_not_created (prowler azure --checks iam_subscription_roles_owner_custom_not_created); PowerPipe control azure_compliance.control.iam_no_custom_subscription_owner_roles_created.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-02 (Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk...), GV.RR-01 (Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is...), GV.RR-02 (Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated...) and 7 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-02
5 more clauses
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
- PR.AA-04
- PR.AA-05
- 6.23 Ensure that no custom subscription administrator roles exist
- 5.23 Ensure that no custom subscription administrator roles exist
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- 1.21 Ensure that no custom subscription owner roles are created
- 1.20 Ensure that no custom subscription owner roles are created
- 1.23 Ensure That No Custom Subscription Owner Roles Are Created
- 1.23 Ensure That No Custom Subscription Administrator Roles Exist
- 1.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 1.22 Ensure That No Custom Subscription Administrator Roles Exist
- 2.23 Ensure That No Custom Subscription Administrator Roles Exist
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
2 more clauses
- 164.308(a)(4)(ii)(C) Access establishment and modification
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_no_custom_subscription_owner_roles_created - Powerpipe Control:
azure_compliance.control.iam_no_custom_subscription_owner_roles_created - Prowler Check:
iam_subscription_roles_owner_custom_not_created
Last reviewed: 2026-10-13