Azure subscriptions should limit owners to 3
It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner. The Azure Policy check A maximum of 3 owners should be designated for your subscription applies to Microsoft.Resources/subscriptions.
The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.
What this control checks
A maximum of 3 owners should be designated for your subscription
Common pitfalls
effect has a defaultValue of AuditIfNotExists
The effect parameter has a defaultValue of AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "A maximum of 3 owners should be designated for your subscription" (4f11b553-d42e-4e3a-89be-32ca364cad4c); Prowler check iam_subscription_owners_between_2_and_3 (prowler azure --checks iam_subscription_owners_between_2_and_3); PowerPipe controls azure_compliance.control.iam_subscription_owner_between_2_and_3 and azure_compliance.control.iam_subscription_owner_max_3.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-6 (Least Privilege) and AC-6(7) (Review of User Privileges).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-02 (Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk...), GV.RR-01 (Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is...), GV.RR-02 (Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated...) and 7 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management) and AC-6 (Least Privilege).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2 Account Management
- AC-6: Least Privilege
- AC-6(7) Review of User Privileges
NIST Cybersecurity Framework v2.0
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
- GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.RR-04: Cybersecurity is included in human resources practices.
- GV.SC-02
5 more clauses
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
- PR.AA-03
- PR.AA-04
- PR.AA-05
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-6 (5): Privileged Accounts
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.
- 5.27 Ensure there are between 2 and 3 subscription owners
- 3.1.c Role based Access Control
- 3.1.f Maker-checker
- 3.1.g Trails
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts
- AC-2 Account Management
- AC-6 Least Privilege
- AC-6(7) Review Of User Privileges
- 1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems
- 1151.01c3System.1-01.c 01.02 Authorized Access to Information Systems
- 11112.01q2Organizational.67-01.q 01.05 Operating System Access Control
- 7.1.1: Define access needs for each role, including: - System components and data resources that each role needs to access for their job function - Level of privilege required (for example, user, administrator, etc.) for accessing resources.
- 7.1.3: Assign access based on individual personnel's job classification and function.
- Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscription_owner_max_3 - Powerpipe Controls:
azure_compliance.control.iam_subscription_owner_between_2_and_3,azure_compliance.control.iam_subscription_owner_max_3 - Prowler Check:
iam_subscription_owners_between_2_and_3 - Azure Policy Definition:
4f11b553-d42e-4e3a-89be-32ca364cad4c
Last reviewed: 2026-10-13