OpenParable
Skip to content
← Back to skills

Cis Azure Foundations 5.3.7

DevOps & Security
cis-azure-foundations-5.3.7

Cis Azure Foundations 5.3.7 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure all non-privileged role assignments are periodically reviewed

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Foundations_Benchmark_v5.0.0/cis-azure-foundations-5.3.7/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-foundations-5-3-7, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure all non-privileged role assignments are periodically reviewed

Description

Perform a periodic review of non-privileged role assignments to ensure that the non-privileged roles assigned to users are appropriate.

Note: Determining 'appropriate' assignments requires a clear understanding of your organization's personnel, systems, policies, and security requirements. This cannot be effectively prescribed in a procedure.

Rationale

To ensure the principle of least privilege is followed, non-privileged role assignments should be reviewed periodically to confirm that users are granted only the minimum level of permissions they need to perform their tasks.

Impact

Increased administrative effort to manage and remove role assignments appropriately.

Audit Procedure

Using Azure Portal

  1. Go to Subscriptions.
  2. Click the name of a subscription.
  3. Click Access control (IAM).
  4. Click Role assignments.
  5. Click Job function roles.
  6. For each role, ensure the assignments are appropriate.
  7. Repeat steps 1-6 for each subscription.

Expected Result

All non-privileged role assignments should be appropriate and justified. No unnecessary or outdated role assignments should exist.

Remediation

Remediate from Azure Portal

  1. Go to Subscriptions.
  2. Click the name of a subscription.
  3. Click Access control (IAM).
  4. Click Role assignments.
  5. Click Job function roles.
  6. Check the box next to any inappropriate assignments.
  7. Click Delete.
  8. Click Yes.
  9. Repeat steps 1-8 for each subscription.

Default Value

Users do not have non-privileged roles assigned to them by default.

References

  1. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v86.8 Define and Maintain Role-Based Access Controlx
v716.6 Maintain an Inventory of Accountsxx

Profile

Level 1 | Manual