MT.1056: Ensure that no person has permanent access to all Azure subscriptions at the root scope

Not run by Mito today

This check needs a connection to Azure Resource Manager, which Mito’s assessment does not set up. Mito reports it as skipped.

ID	MT.1056
Severity	High
Suite	Mito
Product	Azure
Related products	Entra ID
Feature	Access management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts nist-800-53-r5:AC-2 Account Management
MITRE ATT&CK	T1078.004, T1098.003
Reads from	Azure Resource Manager, Microsoft Graph

What this checks and how to fix it

Ensure that no person has permanent access to Azure Subscriptions.

User Access Administrator is a role that allows an Administrator to perform everything on an Azure Subscription. Global Administrators can gain this permission on the Root Scope in Entra ID, in the properties of the Entra ID tenant. These permissions should only be used in case of emergency and should not be assigned permanently.

Ensure that no User Access Administrator permissions at the Root Scope are applied.

Remediation action

To remove all Admins with Root Scope permissions, as a Global Administrator:

1. Navigate to Microsoft Azure Portal https://portal.azure.com.
2. Search for Microsoft Entra ID and select Microsoft Entra ID.
3. Expand the Manage menu and select Properties.
4. On the Properties page, go to the Access management for Azure resources section.
5. In the information bar, click Manage elevated access users.
6. Select all User Access Administrators and click Remove.
7. Also check other role assignments, as they need to be removed to pass the tests.

To remove the admins through CLI:

az role assignment delete --role "User Access Administrator" --assignee adminname@yourdomain.com --scope "/"

Related links

• Manage who can create Microsoft 365 Groups

---

Mito check. Author: Oppedijk; contributors: merill. Open-source licences.