OpenParable
Skip to content
← Back to skills

Cis Azure Foundations 5.25

DevOps & Security
cis-azure-foundations-5.25

Cis Azure Foundations 5.25 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure 'Subscription leaving/entering Microsoft Entra tenant' is set to 'Permit no one'

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-5.25/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-foundations-5-25, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure 'Subscription leaving/entering Microsoft Entra tenant' is set to 'Permit no one'

Description

Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.

Rationale

Permissions to move subscriptions in and out of a Microsoft Entra tenant must only be given to appropriate administrative personnel. A subscription that is moved into a Microsoft Entra tenant may be within a folder to which other users have elevated permissions. This prevents loss of data or unapproved changes of the objects within by potential bad actors.

Impact

Subscriptions will need to have these settings turned off to be moved.

Audit Procedure

Using Azure Portal

  1. From the Azure Portal Home select the portal menu
  2. Select Subscriptions
  3. In the Advanced options drop-down menu, select Manage Policies
  4. Ensure Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Permit no one

Expected Result

Both Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant should be set to Permit no one.

Remediation

Using Azure Portal

  1. From the Azure Portal Home select the portal menu
  2. Select Subscriptions
  3. In the Advanced options drop-down menu, select Manage Policies
  4. Set Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant to Permit no one
  5. Click Save changes

Default Value

By default Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Allow everyone (default).

References

  1. https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/manage-azure-subscription-policy
  2. https://learn.microsoft.com/en-us/entra/fundamentals/how-subscriptions-associated-directory
  3. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-2-protect-identity-and-authentication-systems

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v85.4 Restrict Administrator Privileges to Dedicated Administrator Accountsxxx
v86.1 Establish an Access Granting Processxxx
v86.2 Establish an Access Revoking Processxxx
v74.3 Ensure the Use of Dedicated Administrative Accountsxxx

Profile

Level 2 | Manual