cis-azure-foundations-5-3-5

name	cis-azure-foundations-5.3.5
description	Ensure disabled user accounts do not have read, write, or owner permissions
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","identity","identity-reviews"]
cis_id	5.3.5
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-5.3.4","cis-azure-foundations-5.3.6"]
prerequisites	[]
severity_boost	{}

Ensure disabled user accounts do not have read, write, or owner permissions

Description

Ensure that any roles granting read, write, or owner permissions are removed from disabled Azure user accounts.

While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Removing role assignments from disabled user accounts depends on the context and requirements of each organization and environment.

Rationale

Disabled accounts should not retain access to resources, as this poses a security risk. Removing role assignments mitigates potential unauthorized access and enforces the principle of least privilege.

Impact

Ensure disabled accounts are not relied on for break glass or automated processes before removing roles to avoid service disruption.

Audit Procedure

Using Azure Portal

1. Go to Microsoft Entra ID.
2. Under Manage, click Users.
3. Click Add filter.
4. Click Account enabled.
5. Click the toggle switch to set the value to No.
6. Click Apply.
7. Click the Display name of a disabled user account.
8. Click Azure role assignments.
9. Ensure that no read, write, or owner roles are assigned to the user account.
10. Repeat steps 7-9 for each disabled user account.

Using PowerShell

Connect-AzureAD
Get-AzureADUser

Run the following command to get a user:

$user = Get-AzureADUser -ObjectId <object-id>

Run the following command to get the AccountEnabled setting for the user:

$user.AccountEnabled

If AccountEnabled is False, run the following command to get the role assignments for the user:

Get-AzRoleAssignment -ObjectId $user.ObjectId

Ensure that no read, write, or owner roles are assigned to the user. Repeat for each user.

Using Azure Policy

• Policy ID: 0cfea604-3201-4e14-88fc-fae4c427a6c5 - Name: 'Blocked accounts with owner permissions on Azure resources should be removed'
• 8d7e1fde-fe26-4b5f-8108-f8e432cbc2be - 'Blocked accounts with read and write permissions on Azure resources should be removed'