AZIAM-003: Resource group permission analysis
- Platform
- Entra ID / M365
- Category
- Azure IAM & Resource Security
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Resource groups serve as logical containers for Azure resources and their IAM assignments cascade to all contained resources. Misconfigured resource group permissions can inadvertently grant access to sensitive resources such as databases, key vaults, or virtual machines. Analyzing these permissions ensures consistent enforcement of least-privilege principles.
Recommended value
Apply least-privilege role assignments at the resource group level with documented justification
Remediation
Enumerate all role assignments at each resource group using Get-AzRoleAssignment and review for excessive permissions such as Owner or Contributor roles granted to broad groups. Downgrade overly permissive roles to more specific built-in roles like Reader or specific resource provider roles. Document the business justification for each resource group role assignment and schedule periodic reviews.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6