Control: Azure > CIS v1 > 1 Identity and Access Management > 1.23 Ensure that no custom subscription owner roles are created (Scored)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Subscription ownership should not include permission to create custom owner roles. The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.

Resource Types

This control targets the following resource types:

Azure > IAM > Role Definition

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv1#/control/types/r0123

Category URI

tmod:@turbot/cis#/control/categories/v0704

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv1#/control/types/r0123") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv1#/control/types/r0123'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv1#/control/types/r0123"