Sign in Start Free Trial

Terraform Modules for AWS

AWS Compliance Frameworks

AWS Compliance Controls

Azure Compliance Frameworks

Azure Compliance Controls

Azure subscriptions should have a custom role for administering resource locks Azure subscriptions should have between 2 and 3 owners Azure subscriptions should have more than one owner Azure subscriptions should limit owners to 3 Azure subscriptions should not have blocked accounts with owner permissions Azure subscriptions should not have blocked accounts with read and write permissions Azure subscriptions should not have guest accounts with owner permissions Azure subscriptions should not have guest accounts with read permissions Azure subscriptions should not have guest accounts with write permissions Azure subscriptions should prohibit Custom Subscription Administrator roles Azure subscriptions should restrict use of the 'User Access Administrator' role Custom RBAC roles should not be used Custom roles should not grant overly permissive subscription permissions Disabled user accounts should not have read, write, or owner permissions IAM users should not have the built-in Contributor role

Google Cloud Compliance Frameworks

Google Cloud Compliance Controls

Azure Compliance ControlsAzure RBAC

IAM users should not have the built-in Contributor role

Ensure that IAM user does not have built in contributor role. This rule is non-compliant if IAM user have built in contributor role.

What this control checks

Fails if an IAM user has the built in contributor role.

Related controls

Azure subscriptions should have between 2 and 3 owners
Custom roles should not grant overly permissive subscription permissions
Key vaults should have Role-Based Access Control (RBAC) enabled
Azure Management should require multifactor authentication

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: iam_user_no_built_in_contributor_role
Powerpipe Control: azure_compliance.control.iam_user_no_built_in_contributor_role

Last reviewed: 2026-10-13

View all Azure controls →

Disabled user accounts should not have read, write, or owner permissions

Previous Page

Azure Recovery Services vaults should use private link for backup

Next Page

On this page

Implementation What this control checks Related controls Tool mappings

Ask AI about this

Ask Claude
Ask ChatGPT

Help improve this page

Suggest an edit
Share on LinkedIn

Copyright © 2024-2026 Betajob AS 🇺🇦Build: 20261018_075822_200685

Go to compliance.tf·Registry·Pricing·License Agreement··