Monitor the Total Number of Subscription Owners
More Info:
Ensure that the total number of subscription owners within your Azure account is monitored.Risk Level
MediumAddress
Operational Maturity, SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
Sure! Here are the step-by-step instructions to remediate the misconfiguration of monitoring the total number of subscription owners in Azure:
- Open the Azure portal and log in with your credentials.
- Navigate to the Azure Active Directory service.
- Click on the “Enterprise applications” option from the left-hand side menu.
- In the search bar, type “Azure AD Privileged Identity Management” and select it from the search results.
- Click on the “Manage” button to open the Azure AD Privileged Identity Management console.
- From the left-hand side menu, select “Roles and administrators”.
- In the “Roles and administrators” page, select “Add” to add a new role assignment.
- In the “Add assignment” page, select “Owner” from the “Directory roles” dropdown list.
- In the “Select” page, select the user or group that you want to assign the “Owner” role to.
- Click on the “Assign” button to complete the role assignment.
- Repeat steps 7-10 for all the users or groups that need to be assigned the “Owner” role.
- Once all the users or groups are assigned the “Owner” role, go back to the Azure AD Privileged Identity Management console and select “Settings” from the left-hand side menu.
- In the “Settings” page, select “Notifications”.
- In the “Notifications” page, select “Add notification”.
- In the “Add notification” page, configure the notification settings as per your requirements.
- Click on the “Save” button to save the notification settings.
Using CLI
Using CLI
The misconfiguration “Monitor the Total Number of Subscription Owners” can be remediated in Azure using the following steps:
- Open a command prompt or terminal window.
-
Login to Azure using the Azure CLI command:
-
Select the subscription that you want to monitor using the following command:
-
Retrieve the number of subscription owners using the following command:
This command retrieves all the role assignments with the “Owner” role, filters out the principal names, sorts and counts the unique principal names.
-
Set up a notification to alert you when the number of subscription owners changes. You can use Azure Monitor to create an alert rule that sends an email or SMS notification when the number of subscription owners exceeds a certain threshold.
Replace
<alert-name>and<alert-description>with a name and description for your alert,<threshold>with the number of subscription owners that triggers the alert,<subscription-id>with the ID of your subscription, and<email-address>with the email address to which notifications should be sent. This command creates an alert rule that monitors the “total subscription owners” metric for your subscription, evaluates it every minute, and sends an email notification if the threshold is exceeded. - Verify that the alert is working by adding or removing subscription owners and checking that you receive notifications when the threshold is exceeded.
Using Python
Using Python
To monitor the total number of subscription owners in Azure, you can use the Azure Management API. Here are the steps to remediate this issue using Python:Step 1: Install the Azure SDK for PythonYou can install the Azure SDK for Python using pip. Open the terminal and run the following command:Step 2: Authenticate with AzureTo authenticate with Azure, you need to create a service principal. You can create a service principal using the Azure CLI or the Azure portal. Once you have the service principal details, you can use them to authenticate with Azure. Here’s an example code snippet:Step 3: Get the Subscription OwnersOnce you’re authenticated with Azure, you can use the Azure Management API to get the subscription owners. Here’s an example code snippet:This code snippet gets the subscription owners by querying the Azure Management API. The This code snippet checks if there are more than two subscription owners. If there are, it calculates the number of excess owners and prints a message indicating the total number of subscription owners and the number of excess owners. You can replace the comment with the code to remove the excess owners.
ResourceManagementClient is used to interact with the Azure Resource Manager API. The providers.get method is used to get the role assignments for the Microsoft.Authorization provider. The properties.permissions attribute contains the list of permissions for the provider. The actions attribute contains the list of actions that can be performed on the resource. The notActions attribute contains the list of actions that cannot be performed on the resource. The dataActions attribute contains the list of data actions that can be performed on the resource. The notDataActions attribute contains the list of data actions that cannot be performed on the resource. Finally, the principalIds attribute contains the list of principal IDs for the role assignment.Step 4: Remediate the IssueTo remediate the issue, you need to ensure that there are no more than two subscription owners. If there are more than two subscription owners, you can remove the excess owners. Here’s an example code snippet: