Roles Having Suspicious Access
More Info:
Roles which have suspicious accesssRisk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of roles having suspicious access in Azure IAM (Identity and Access Management) using the Azure console, follow these steps:
- Sign in to the Azure portal (https://portal.azure.com) using your Azure account credentials.
- In the Azure portal, navigate to the Azure Active Directory (AAD) service. You can find it by searching for “Azure Active Directory” in the search bar at the top.
- In the Azure Active Directory dashboard, select “Roles and administrators” from the left-hand menu.
- On the Roles and administrators page, you will see a list of built-in roles and custom roles defined in your Azure AD tenant. Review the roles and identify any suspicious roles that have unauthorized or excessive access permissions.
- Click on the suspicious role to view its details and permissions.
- In the role details page, review the assigned users, groups, or applications to identify any unauthorized assignments. Remove any inappropriate assignments by selecting the assignment and clicking on the “Remove” button.
- If the suspicious role is a custom role, you may need to modify its permissions to limit access. Click on the “Permissions” tab and review the permissions assigned to the role. Remove any unnecessary or excessive permissions by selecting them and clicking on the “Remove” button.
- Once you have removed unauthorized assignments and modified permissions if required, click on the “Save” button to apply the changes.
- Repeat steps 5 to 8 for all suspicious roles identified in your Azure AD tenant.
- After remediation, it is recommended to monitor the roles and access permissions regularly to ensure ongoing security. Consider implementing Azure AD Privileged Identity Management (PIM) to enforce just-in-time access and periodic access reviews for critical roles.
Using CLI
Using CLI
To remediate the issue of roles having suspicious access in Azure using Azure CLI, follow these steps:
-
Identify the suspicious roles:
- Run the following command to list all the roles in your Azure subscription:
- Review the output and identify any roles that seem suspicious or have unnecessary permissions.
- Run the following command to list all the roles in your Azure subscription:
-
Revoke suspicious roles:
- Run the following command to revoke a role from a specific user or service principal:
Replace
<assignee-object-id>with the object ID of the user or service principal you want to revoke the role from, and<role-name>with the name of the suspicious role. - Repeat this command for each suspicious role that needs to be revoked.
- Run the following command to revoke a role from a specific user or service principal:
-
Review and modify built-in roles:
- Run the following command to list all built-in roles in your Azure subscription:
- Review the output and identify any built-in roles that have excessive permissions.
- To modify a built-in role, create a custom role with the necessary permissions and assign it instead. You can use the
az role definition createcommand to create a custom role and theaz role assignment createcommand to assign it.
- Run the following command to list all built-in roles in your Azure subscription:
-
Implement Just-in-Time (JIT) access:
- JIT access allows you to grant temporary, time-bound access to specific roles when needed. This reduces the risk of unauthorized access.
- Follow the Azure documentation to configure and enable JIT access for your Azure resources: Azure JIT access documentation
-
Regularly review and update role assignments:
- It’s important to periodically review and update role assignments in your Azure subscription to ensure they align with your organization’s security requirements.
- Use the Azure portal, Azure CLI, or Azure PowerShell to review and manage role assignments regularly.
Using Python
Using Python
To remediate the issue of roles having suspicious access in Azure using Python, follow these steps:
-
Install the required dependencies:
-
Import the necessary modules:
-
Authenticate to Azure using default credentials:
-
Retrieve the list of roles in the subscription:
-
Iterate through each role to identify suspicious access:
-
Once suspicious roles are identified, you can take appropriate actions, such as removing or modifying the role. To remove a role, use the following code:
Note: Replace
<role-id-to-remove>with the actual ID of the role you want to remove. -
If you want to modify the role, you can update its permissions using the following code:
Note: Replace
<role-id-to-modify>with the actual ID of the role you want to modify, and<action-1>,<action-2>, etc., with the desired actions. - Finally, run the Python script to remediate the suspicious access issue.