Back to Checks
azure

Role assignment does not grant the User Access Administrator role

iam_role_user_access_admin_restricted
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.authorization/roleassignments

Azure subscription role assignments granting User Access Administrator are identified to surface principals able to manage access (Azure RBAC) at that scope.

Prowler logoProwlerprowler-provider-azure

Risk

Persistent User Access Administrator enables assigning high-privilege roles and reading control-plane data, enabling privilege escalation and unauthorized access. Impact: confidentiality (data exposure), integrity (unauthorized changes), availability (service disruption).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks iam_role_user_access_admin_restricted

Recommendation

Enforce least privilege:

  • Avoid standing User Access Administrator; use time-bound, approval-based elevation (PIM)
  • Scope access to only required subscriptions/resource groups
  • Require MFA and monitor role activity
  • Review regularly and remove unused grants

Remediation

CLI

az role assignment delete --assignee <principal_id_or_upn> --role "User Access Administrator" --scope "/subscriptions/<subscription_id>"

Other

1In the Azure portal, go to Subscriptions and select <subscription>.
2Open Access control (IAM) > Role assignments.
3Filter by Role = User Access Administrator.
4Select the assignment(s) and click Remove. Confirm.

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.iam.iam_client import iam_client


class iam_role_user_access_admin_restricted(Check):
    def execute(self):
        findings = []

        for subscription_id, assignments in iam_client.role_assignments.items():
            subscription_name = iam_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for assignment in assignments.values():
                role_assignment_name = getattr(
                    iam_client.roles[subscription_id].get(
                        f"/subscriptions/{subscription_id}/providers/Microsoft.Authorization/roleDefinitions/{assignment.role_id}"
                    ),
                    "name",
                    "",
                )
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=assignment
                )
                report.subscription = subscription_id
                if role_assignment_name == "User Access Administrator":
                    report.status = "FAIL"
                    report.status_extended = f"Role assignment {assignment.name} in subscription {subscription_name} ({subscription_id}) grants User Access Administrator role to {getattr(assignment, 'agent_type', '')} {getattr(assignment, 'agent_id', '')}."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Role assignment {assignment.name} in subscription {subscription_name} ({subscription_id}) does not grant User Access Administrator role."
                findings.append(report)
        return findings

References