# Cis Azure Database 4.4

> Ensure that Data Factory is using RBAC to manage privilege assignment

- Skill: `cyberstrikeus/cis-azure-database-4-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-database-4-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-database-4-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-database-4-4

---


# 4.4 Ensure that Data Factory is using RBAC to manage privilege assignment (Manual)

## Profile Applicability

- Level 2

## Description

Role Based Access Control (RBAC) is setting permissions to the role that a user occupies. Often the user is added to a group which the account inherits permissions from. This is different than Access Policies which are used on an individual case by case basis for each user.

## Rationale

RBAC enhances security by limiting user privilege to only what is necessary for a job role, reducing the risk of unauthorized access. Additionally, RBAC aids compliance with regulations and provides clear accountability by tracking access activities linked to specific roles.

## Impact

There will be a slight increase in technical overhead in that user permissions will need to be manually assigned. However once added to a group, permissions may be edited for every account in the group at one time.

## Audit

### Audit from Azure Portal

1. From `Data Factories` select a data factory to audit.
2. In the left column select `Access control (IAM)`.
3. To check an individual account or group, in the horizontal row, select `Check access`, then search for a user, group, or managed identity.
4. To check all roles, in the horizontal row select `Role assignments`, and scroll through all the roles that have permission to this data factory.

## Expected Result

Appropriate RBAC role assignments should be configured for the Data Factory, with roles scoped to the minimum necessary permissions for each user or group.

## Remediation

### Remediate from Azure Portal

1. From `Data Factories` select a data factory to audit.
2. In the left column select `Access control (IAM)`.
3. Select `+ Add \/` and then `Add role assignment`.
4. Select the builtin or custom role to be added. Then select `Next`.
5. Next to `Assign access to` select either `User, group, or service principal` or `Managed identity` to be added to this role.
6. Choose `Select members`, then search for the resource that is to be added to this role.
7. Enter a description if desired.
8. Select `Next`, review your choices, then `Review + assign`.

## Default Value

By default, Data factories use RBAC but only with permissions for owners to make changes.

## References

1. https://learn.microsoft.com/en-us/azure/data-factory/concepts-roles-permissions