# Cis Azure Foundations 5.27

> Ensure there are between 2 and 3 subscription owners

- Skill: `cyberstrikeus/cis-azure-foundations-5-27` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-foundations-5-27`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-foundations-5-27/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-foundations-5-27

---


# Ensure there are between 2 and 3 subscription owners

## Description

The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.

## Rationale

Limit the number of security principals (users, groups, service principals, and managed identities) assigned the Owner role to between 2 and 3. If groups are used, ensure their membership is tightly controlled and regularly reviewed to avoid privilege sprawl.

## Impact

Implementation may require changes in administrative workflows or the redistribution of roles and responsibilities. The recommendation to have between 2 and 3 Owners per subscription must account for all security principals that can be assigned the Owner role, not just individual users. This includes:

- User accounts
- Entra ID groups
- Service principals (used by applications or automation)
- Managed identities (system-assigned or user-assigned)

## Audit Procedure

### Using Azure Portal

1. Go to `Subscriptions`.
2. Click the name of a subscription.
3. Click `Access Controls (IAM)`.
4. Click `Role assignments`.
5. Click `Role : All`.
6. Click the arrow next to `All`.
7. Click `Owner`.
8. Ensure a minimum of 2 and a maximum of 3 members are returned.
9. Repeat steps 1-8 for each subscription.

### Using Azure CLI

```bash
az role assignment list --role Owner --scope /subscriptions/<subscription-id> \
  --query "[].{PrincipalName:principalName, Type:principalType}"
```

Ensure a minimum of 2 and a maximum of 3 members are returned. For each Owner assignment, check: If principalType == Group, review group membership. If principalType == ServicePrincipal or ManagedIdentity, validate necessity and scope. Repeat for each subscription.

### Using PowerShell

```powershell
Get-AzRoleAssignment -RoleDefinitionName Owner -Scope /subscriptions/<subscription-id>
```

Ensure a minimum of 2 and a maximum of 3 members are returned. Repeat for each subscription.

### Using Azure Policy

- **Policy ID:** 09024ccc-0c5f-475e-9457-b7c0d9ed487b - **Name:** 'There should be more than one owner assigned to your subscription'
- **Policy ID:** 4f11b553-d42e-4e3a-89be-32ca364cad4c - **Name:** 'A maximum of 3 owners should be designated for your subscription'

## Expected Result

Each subscription should have a minimum of 2 and a maximum of 3 owners assigned.

## Remediation

### Using Azure Portal

1. Go to `Subscriptions`.
2. Click the name of a subscription.
3. Click `Access Controls (IAM)`.
4. Click `Role assignments`.
5. Click `Role : All`.
6. Click the arrow next to `All`.
7. Click `Owner`.
8. Check the box next to members from whom the owner role should be removed.
9. Click `Delete`.
10. Click `Yes`.
11. Repeat steps 1-10 for each subscription requiring remediation.

### Using Azure CLI

```bash
az role assignment delete --ids <role-assignment-ids>
```

## Default Value

A subscription has 1 owner by default.

## References

1. https://learn.microsoft.com/en-us/cli/azure/role/assignment
2. https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azroleassignment
3. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner
4. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-admin

## CIS Controls

| Controls Version | Control                                             | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------- | ---- | ---- | ---- |
| v8               | 5.1 Establish and Maintain an Inventory of Accounts | x    | x    | x    |
| v7               | 4.1 Maintain Inventory of Administrative Accounts   |      | x    | x    |

## Profile

Level 1 | Automated