Skip to content

Azure access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Azure, Black Cat runs 8 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Azure connector needs.

Checks (8)

severity: medium Owner Count Exceeded fix difficulty: easy #

Reduce the number of subscription Owners to three or fewer

  1. Sign in to the Azure Portal and navigate to Subscriptions
  2. Select the affected subscription and click Access control (IAM)
  3. Click the Role assignments tab and filter by the Owner role
  4. Identify users who should not have Owner permissions
  5. Select each unnecessary Owner and click Remove
  6. Confirm the removal and verify the Owner count is within the limit

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Custom Admin Roles fix difficulty: medium #

Replace custom admin roles with built-in RBAC roles scoped to least privilege

  1. Navigate to the Azure Portal and open Subscriptions
  2. Select the subscription and click Access control (IAM)
  3. Click Roles and filter for custom roles with wildcard or broad action permissions
  4. Review each custom role definition for overly permissive actions
  5. Replace users assigned to the custom role with appropriate built-in roles (e.g. Contributor, Reader)
  6. Delete or restrict the custom role definition once no users are assigned

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Classic Administrators fix difficulty: easy #

Remove classic Co-Administrator and Service Administrator role assignments

  1. Navigate to the Azure Portal and open Subscriptions
  2. Select the affected subscription and click Access control (IAM)
  3. Click the Classic administrators tab
  4. Review co-administrators listed and identify those no longer required
  5. Click the three-dot menu next to each unnecessary co-administrator and select Remove
  6. Confirm removal and reassign required permissions using modern RBAC roles instead

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Guest Privileged Role fix difficulty: medium #

Remove privileged role assignments from guest (external) user accounts

  1. Navigate to the Microsoft Entra admin center and open Users
  2. Filter the user list by User type set to Guest
  3. For each guest user, click the name and select Azure role assignments
  4. Identify and remove any Owner, Contributor, or other privileged role assignments
  5. If the guest requires access, assign a least-privilege role scoped to a specific resource group
  6. Review and revoke guest user access in Active Directory under External identities if no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Key Vault RBAC Not Enabled fix difficulty: medium #

Switch the Key Vault permission model to Azure RBAC for centralized access control

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Access configuration
  3. Under Permission model, select Azure role-based access control
  4. Click Apply to switch from the vault access policy model
  5. Assign appropriate built-in Key Vault roles (Key Vault Administrator, Secrets User, etc.) to users and service principals
  6. Remove any legacy access policies that are no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SQL AD Admin Not Configured fix difficulty: easy #

Configure a Microsoft Entra ID administrator for the Azure SQL Server

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Microsoft Entra admin under Settings
  3. Click Set admin
  4. Search for and select an appropriate Entra ID user or security group
  5. Click Select and then Save to assign the Entra admin
  6. Verify the Entra admin is shown as configured on the Microsoft Entra admin page

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high App Service Managed Identity Disabled fix difficulty: medium #

Enable a system-assigned or user-assigned managed identity on the App Service

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Identity under Settings
  3. On the System assigned tab, set the Status toggle to On
  4. Click Save and confirm the change in the dialog
  5. Assign the managed identity the minimum required RBAC roles for accessing other Azure resources
  6. Update the application configuration to use managed identity authentication instead of stored credentials

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high App Service Auth Disabled fix difficulty: medium #

Enable App Service Authentication to require identity provider login for the application

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Authentication under Settings
  3. Click Add identity provider
  4. Select the appropriate identity provider (e.g. Microsoft, Google, GitHub)
  5. Configure the provider credentials and callback URL
  6. Set the Unauthenticated requests action to HTTP 401 or Redirect to identity provider

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Azure checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial