AZIAM-002: Users with Azure IAM roles directly on resources
- Plataforma
- Entra ID / M365
- Categoría
- Azure IAM & Resource Security
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Direct role assignments to individual users on Azure resources bypass group-based access governance and make permission tracking difficult. This practice increases the risk of orphaned permissions when users change roles or leave the organization. Group-based assignments provide better auditability and lifecycle management.
Valor recomendado
Assign roles to Azure AD groups rather than directly to individual users
Remediación
Identify all direct user-to-resource role assignments using Azure Resource Graph or the IAM blade. Create appropriate Azure AD security groups for each access pattern and migrate individual assignments to group-based assignments. Remove the direct user assignments after confirming group membership grants equivalent access.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1)
- CIS Azure
- 1.23