Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-5-27The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
| name | cis-azure-foundations-5.27 |
| description | Ensure there are between 2 and 3 subscription owners |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","subscription-owners","rbac","least-privilege"] |
| cis_id | 5.27 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.26","cis-azure-foundations-5.23"] |
| prerequisites | [] |
| severity_boost | {} |
The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.
Limit the number of security principals (users, groups, service principals, and managed identities) assigned the Owner role to between 2 and 3. If groups are used, ensure their membership is tightly controlled and regularly reviewed to avoid privilege sprawl.
Implementation may require changes in administrative workflows or the redistribution of roles and responsibilities. The recommendation to have between 2 and 3 Owners per subscription must account for all security principals that can be assigned the Owner role, not just individual users. This includes:
Subscriptions.Access Controls (IAM).Role assignments.Role : All.All.Owner.az role assignment list --role Owner --scope /subscriptions/<subscription-id> \
--query "[].{PrincipalName:principalName, Type:principalType}"
Ensure a minimum of 2 and a maximum of 3 members are returned. For each Owner assignment, check: If principalType == Group, review group membership. If principalType == ServicePrincipal or ManagedIdentity, validate necessity and scope. Repeat for each subscription.
Get-AzRoleAssignment -RoleDefinitionName Owner -Scope /subscriptions/<subscription-id>
Ensure a minimum of 2 and a maximum of 3 members are returned. Repeat for each subscription.
Each subscription should have a minimum of 2 and a maximum of 3 owners assigned.
Subscriptions.Access Controls (IAM).Role assignments.Role : All.All.Owner.Delete.Yes.az role assignment delete --ids <role-assignment-ids>
A subscription has 1 owner by default.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.1 Establish and Maintain an Inventory of Accounts | x | x | x |
| v7 | 4.1 Maintain Inventory of Administrative Accounts | x | x |
Level 1 | Automated