# Cis Azure Compute 3.3

> Ensure the principle of least privilege is used when assigning roles to a Managed Identity

- Skill: `cyberstrikeus/cis-azure-compute-3-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-compute-3-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-compute-3-3/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-compute-3-3

---


# Ensure the principle of least privilege is used when assigning roles to a Managed Identity

## Description

When using either a user-assigned or system-assigned managed identity, those identities may require a role or privilege assignment to perform a desired function. The roles or privileges assigned to that identity should be assigned with the principle of least privilege in mind - the identity is given the minimum levels of access or permissions needed to perform the job.

## Rationale

Threat actors may attempt to compromise service accounts as anomalous activity on these accounts can sometimes be more challenging to detect. Limiting the permissions or roles available to a managed identity or service account assists in mitigating the systemic exploitation that a service account can perform if compromised.

## Impact

All service accounts should be inventoried and reviewed from time to time for necessity and role or privilege assignment.

## Audit Procedure

### Using Azure Portal

For each Container Instance that uses an identity or credential:

1. Open the `Container Instances` blade.
2. Select a named container instance.
3. Click on `Identity` under the Settings section.
4. Review the `System Assigned` and `User Assigned` tabs for assigned identities.

For a System Assigned identity, click on `Azure role assignments` and review the assigned roles for appropriate restriction.

For User assigned identities, click on the name of each User assigned managed identity, then click on `Azure role assignments` in the left panel to review assigned roles for appropriate restriction.

## Expected Result

All managed identities assigned to Container Instances should have only the minimum required roles and permissions necessary for their intended function.

## Remediation

### Using Azure Portal

**NOTE**: Remediation will vary based on the needs of your environment. Before remediating, determine the scope and requirements of the Role Assignments necessary for your environment: https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

For each Container Instance that uses an identity or credential:

1. Open the `Container Instances` blade.
2. Select a named container instance.
3. Click on `Identity` under the Settings section.
4. Review the `System Assigned` and `User Assigned` tabs for assigned identities.

For a System Assigned identity, click on `Azure role assignments` and Add or Remove assigned roles for appropriate restriction.

For User assigned identities, click on the name of each User assigned managed identity, then click on `Azure role assignments` in the left panel to Add or Remove assigned roles for appropriate restriction.

## Default Value

By default, Managed Identities are not configured on Container Instances.

## References

1. https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity
2. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
3. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-managed-identity
4. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

## Profile

Level 1 | Manual