Azure Compliance ControlsAzure RBAC
Azure subscriptions should restrict use of the 'User Access Administrator' role
Prowler check iam_role_user_access_admin_restricted flags Azure subscription role assignments granting User Access Administrator. It surfaces principals able to manage access (Azure RBAC) at that scope.
What this control checks
Role assignment must not grant the User Access Administrator role.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.3.3 Ensure that use of the 'User Access Administrator' role is restricted
- 5.3.3 Ensure that use of the 'User Access Administrator' role is restricted
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
9 more clauses
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OIS-02.02B Top management of the cloud service provider has communicated the information security policy to internal and external employees as well as cloud service customers.
- OIS-04.01B Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment...
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body.
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii)(B) Workforce clearance procedure
- 164.308(a)(4)(i) Information access management
- 164.308(a)(4)(ii)(B) Access authorization
- 164.308(a)(4)(ii)(C) Access establishment and modification
1 more clause
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_user_access_administrator_role_restricted - Powerpipe Control:
azure_compliance.control.iam_user_access_administrator_role_restricted - Prowler Check:
iam_role_user_access_admin_restricted
Last reviewed: 2026-10-13