Cis Azure Foundations 5.3.3
DevOps & Securitycis-azure-foundations-5.3.3Cis Azure Foundations 5.3.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure use of the 'User Access Administrator' role is restricted
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-5.3.3/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-foundations-5-3-3, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure use of the 'User Access Administrator' role is restricted
Description
The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant. Due to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks.
Rationale
The User Access Administrator role provides extensive access control privileges. Unnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.
Impact
Increased administrative effort to manage and remove role assignments appropriately.
Audit Procedure
Using Azure Portal
- From Azure Home select the Portal Menu.
- Select
Subscriptions. - Select a subscription.
- Select
Access control (IAM). - Look for the following banner at the top of the page:
Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access.If the banner is displayed, theUser Access Administratoris assigned.
Using Azure CLI
az role assignment list --role "User Access Administrator" --scope "/"
Ensure that the command does not return any User Access Administrator role assignment information.
Expected Result
No users should have the User Access Administrator role assigned at the root scope ("/"). The Azure CLI command should return an empty result, and no banner warning should appear in the Azure Portal.
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Subscriptions. - Select a subscription.
- Select
Access control (IAM). - Look for the following banner at the top of the page:
Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access. - Click
View role assignments. - Click
Remove.
Remediate from Azure CLI
az role assignment delete --role "User Access Administrator" --scope "/"
Default Value
The User Access Administrator role is not assigned by default.
References
- https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
- https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.8 Define and Maintain Role-Based Access Control | x | ||
| v7 | 4.1 Maintain Inventory of Administrative Accounts | x | x |
Profile
Level 1 | Automated