Back to Checks
azure

AKS cluster has local accounts disabled

aks_cluster_local_accounts_disabled
Service: aksSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.containerservice/managedclusters

Azure Kubernetes Service clusters are evaluated for local account status. Disabling local accounts forces all cluster authentication through Microsoft Entra ID, ensuring centralized identity management, MFA, and conditional access.

Prowler logoProwlerprowler-provider-azure

Risk

Local accounts bypass Entra ID authentication, MFA, and conditional access policies. Compromised local credentials (such as the static cluster-admin certificate) provide persistent cluster access without an identity-based audit trail or governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aks_cluster_local_accounts_disabled

Recommendation

Disable local accounts on AKS clusters and require Microsoft Entra ID authentication with Azure RBAC. Before disabling, confirm Entra ID integration and break-glass access are in place so administrators retain authenticated access, then enforce MFA and conditional access on cluster identities.

Remediation

CLI

az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --disable-local-accounts

Terraform

# Terraform: AKS cluster with local accounts disabled
resource "azurerm_kubernetes_cluster" "<example_resource_name>" {
  name                  = "<example_resource_name>"
  location              = "<region>"
  resource_group_name   = "<example_resource_name>"
  dns_prefix            = "<example_resource_name>"
  local_account_disabled = true # CRITICAL: forces authentication through Entra ID

  azure_active_directory_role_based_access_control {
    azure_rbac_enabled = true
  }
}

NativeIaC

// Bicep: AKS cluster with local accounts disabled
resource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    disableLocalAccounts: true // CRITICAL: forces authentication through Entra ID
    aadProfile: {
      managed: true
      enableAzureRbac: true
    }
  }
}

Other

1Sign in to the Azure portal and open your AKS cluster
2Ensure Microsoft Entra ID (AAD) authentication is configured for the cluster
3Under Settings, select Cluster configuration (or Authentication and Authorization)
4Set Local accounts to Disabled
5Save the configuration

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aks.aks_client import aks_client


class aks_cluster_local_accounts_disabled(Check):
    """
    Ensure local accounts are disabled on AKS clusters.

    This check evaluates whether each Azure Kubernetes Service cluster has local accounts disabled, forcing all authentication through Microsoft Entra ID.

    - PASS: The cluster has local accounts disabled.
    - FAIL: The cluster has local accounts enabled.
    """

    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription_name, clusters in aks_client.clusters.items():
            for cluster in clusters.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
                report.subscription = subscription_name

                if cluster.local_accounts_disabled:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Cluster '{cluster.name}' has local accounts disabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Cluster '{cluster.name}' has local accounts enabled."
                    )

                findings.append(report)

        return findings

References