Azure Compliance ControlsAzure RBAC
Custom roles should not grant overly permissive subscription permissions
Custom roles should not be owner-equivalent. Prowler analyzes Azure custom roles for wildcard permissions, and roles that allow `*` in actions are treated as owner-equivalent. Permissions granted to a role should be kept to the minimum required.
What this control checks
Custom roles must not allow * in actions; wildcard permissions must not be used.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.23 Ensure that no custom subscription administrator roles exist
- 5.23 Ensure that no custom subscription administrator roles exist
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- 1.23 Ensure That No Custom Subscription Administrator Roles Exist
- 1.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- 1.22 Ensure That No Custom Subscription Administrator Roles Exist
- 2.23 Ensure That No Custom Subscription Administrator Roles Exist
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
2 more clauses
- 164.308(a)(4)(ii)(C) Access establishment and modification
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscriptions_with_custom_roles_no_overly_permissive - Checkov Check:
CKV_AZURE_39 - Powerpipe Controls:
azure_compliance.control.iam_no_custom_subscription_owner_roles_created,azure_compliance.control.iam_subscriptions_with_custom_roles_no_overly_permissive - Prowler Check:
iam_subscription_roles_owner_custom_not_created - Trivy Check:
AZU-0030
Last reviewed: 2026-10-13