> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit keyvault entities with full admin privileges remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration in Azure where a user, group, or application has full administrator privileges, follow these steps: 1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Navigate to the "Azure Active Directory" service. 3. Click on "Users" or "Groups" depending on which entity has full administrator privileges. 4. Select the user or group that has full administrator privileges. 5. Click on the "Directory role" tab. 6. Click on "None" to remove all roles assigned to the user or group. 7. Click "Save" to apply the changes. 8. Repeat the above steps for any other users or groups that have full administrator privileges. 9. To ensure that no application has full administrator privileges, navigate to the "Enterprise Applications" service. 10. Click on the application that has full administrator privileges. 11. Click on the "Properties" tab. 12. Under "Permissions", click on "Remove permission". 13. Click "Yes" to confirm the removal of all permissions. 14. Repeat the above steps for any other applications that have full administrator privileges. By following these steps, you will have successfully remediated the misconfiguration where a user, group, or application has full administrator privileges in Azure. # To remediate the misconfiguration of having User, Group or Applications with full administrator privileges in AZURE using AZURE CLI, follow these steps: 1. Login to your AZURE account using the AZURE CLI by running the command `az login` and enter your credentials. 2. Once you are logged in, you need to identify the user, group or application that has full administrator privileges in your AZURE subscription. You can do this by running the command `az role assignment list --all` which will list all the role assignments in your subscription. 3. Identify the role assignment that has full administrator privileges and make a note of the `principalId` value. 4. Next, you need to remove the role assignment from the user, group or application that has full administrator privileges. You can do this by running the command `az role assignment delete --assignee --role "Owner"` where `` is the value you noted in step 3. 5. Once the role assignment has been removed, you should verify that the user, group or application no longer has full administrator privileges. You can do this by running the command `az role assignment list --all` again and verifying that the role assignment has been removed. 6. Finally, you should ensure that the user, group or application has the appropriate level of access required to perform their tasks. You can assign them a more appropriate role or create a custom role with the required permissions using the AZURE CLI. To remediate the misconfiguration of having user, group, or applications with full administrator privileges in Azure using Python, you can follow these steps: 1. Connect to Azure using Python SDK: Use the Azure SDK for Python to connect to your Azure account. You can use the `azure.identity` and `azure.mgmt.authorization` modules to authenticate and access the Azure resources. 2. Get the list of users, groups, and applications with full administrator privileges: Use the `RoleAssignmentsOperations` class from the `azure.mgmt.authorization` module to get the list of role assignments that have full administrator privileges. You can filter the role assignments based on the `role_definition_id` property that corresponds to the built-in `Owner` role. 3. Revoke the full administrator privileges: Use the `RoleAssignmentsOperations` class to revoke the full administrator privileges from the users, groups, and applications that have them. You can use the `delete_by_id` method to delete the role assignments. Here's some sample code that demonstrates how to revoke the full administrator privileges from users, groups, and applications in Azure using Python: ``` from azure.identity import DefaultAzureCredential from azure.mgmt.authorization import AuthorizationManagementClient # Connect to Azure using the default credentials credential = DefaultAzureCredential() authorization_client = AuthorizationManagementClient(credential, "") # Get the list of role assignments with full administrator privileges role_assignments = authorization_client.role_assignments.list(filter="roleDefinitionId eq '/subscriptions//providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635'") # Revoke the full administrator privileges from each role assignment for role_assignment in role_assignments: authorization_client.role_assignments.delete_by_id(role_assignment.id) ``` Note: Replace `` with your actual subscription ID. ```hcl theme={null} # Azure Key Vault with RBAC or minimal access policies resource "azurerm_key_vault" "THIS_VAULT" { name = "KEY_VAULT_NAME" # replace with your vault name location = azurerm_resource_group.RG.location resource_group_name = azurerm_resource_group.RG.name tenant_id = "TENANT_ID" # replace with your AAD tenant ID sku_name = "standard" # If you are using Azure RBAC instead of access policies, enable this and # remove any azurerm_key_vault_access_policy resources. # Recommended for new deployments. public_network_access_enabled = true purge_protection_enabled = true soft_delete_retention_days = 90 enable_rbac_authorization = true } # Example: restrict an existing principal that previously had full admin ("all") permissions. # Replace PRINCIPAL_OBJECT_ID with the AAD object ID of the user/group/app. resource "azurerm_key_vault_access_policy" "LEAST_PRIV_PRINCIPAL" { key_vault_id = azurerm_key_vault.THIS_VAULT.id tenant_id = azurerm_key_vault.THIS_VAULT.tenant_id object_id = "PRINCIPAL_OBJECT_ID" # User, Group, or Application object ID # DO NOT USE ["all"]; enumerate only the permissions actually needed. # Example: an app that only needs to read and list secrets. key_permissions = [ # leave empty if the principal does not need key access ] secret_permissions = [ "Get", "List", ] certificate_permissions = [ # leave empty if the principal does not need certificate access ] storage_permissions = [ # leave empty if the principal does not need storage account key access ] } ``` Changing access policies does not force replacement of the Key Vault, but it may immediately restrict or remove administrator capabilities for the affected principals, so confirm the minimal permissions required before applying. For verification, `terraform plan` should show that any prior `azurerm_key_vault_access_policy` (or inline `access_policy` blocks) granting `"all"` or broad admin permissions to users, groups, or apps are being removed or updated, and that the remaining policy (or RBAC) only includes the explicitly listed least-privilege permissions.