Custom roles should not grant overly permissive subscription permissions
Custom roles should not be owner-equivalent. Prowler analyzes Azure custom roles for wildcard permissions, and roles that allow `*` in actions are treated as owner-equivalent. Permissions granted to a role should be kept to the minimum required.
Wildcard access grants full administrative control at subscription scope. If abused or compromised, an actor can exfiltrate data, alter configurations, deploy malware, delete resources, and disable logging, impacting confidentiality, integrity, and availability across the subscription.
What this control checks
Custom roles must not allow * in actions; wildcard permissions must not be used.
Common pitfalls
Wildcard roles are owner-equivalent
Roles that allow * in actions within their assignable scopes are treated as owner-equivalent, granting unrestricted control over subscription resources.
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_subscription_roles_owner_custom_not_created (prowler azure --checks iam_subscription_roles_owner_custom_not_created); PowerPipe controls azure_compliance.control.iam_no_custom_subscription_owner_roles_created and azure_compliance.control.iam_subscriptions_with_custom_roles_no_overly_permissive.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_39; Trivy check AZU-0030.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 6.23 (Ensure that no custom subscription administrator roles exist).
CIS Azure Benchmark v5.0.0: Mapped to 5.23 (Ensure that no custom subscription administrator roles exist).
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-7-1 (Annex I (7.1) - Disallow administrative rights on end-user workstations/PCs/laptops and provide access rights on a...).
BSI C5:2025: Mapped to IAM-01.01B (The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and...), IAM-06.02B (Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for...), OIS-02.01B (Top management of the cloud service provider has adopted an information security policy.) and 2 more clauses.
CIS Azure Benchmark v2.0.0: Mapped to 1.23 (Ensure That No Custom Subscription Administrator Roles Exist) and 1.24 (Ensure a Custom Role is Assigned Permissions for Administering Resource Locks).
CIS Azure Benchmark v2.1.0: Mapped to 1.22 (Ensure That No Custom Subscription Administrator Roles Exist).
CIS Azure Benchmark v3.0.0: Mapped to 2.23 (Ensure That No Custom Subscription Administrator Roles Exist).
HIPAA Security Rule 2003: Mapped to 164.308(a)(1)(ii)(B) (Risk Management), 164.308(a)(3)(i) (Workforce security), 164.308(a)(3)(ii)(B) (Workforce clearance procedure) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.23 Ensure that no custom subscription administrator roles exist
- 5.23 Ensure that no custom subscription administrator roles exist
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- 1.23 Ensure That No Custom Subscription Administrator Roles Exist
- 1.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 1.22 Ensure That No Custom Subscription Administrator Roles Exist
- 2.23 Ensure That No Custom Subscription Administrator Roles Exist
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
2 more clauses
- 164.308(a)(4)(ii)(C) Access establishment and modification
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscriptions_with_custom_roles_no_overly_permissive - Checkov Check:
CKV_AZURE_39 - Powerpipe Controls:
azure_compliance.control.iam_no_custom_subscription_owner_roles_created,azure_compliance.control.iam_subscriptions_with_custom_roles_no_overly_permissive - Prowler Check:
iam_subscription_roles_owner_custom_not_created - Trivy Check:
AZU-0030
Last reviewed: 2026-10-13