Detections
Analytics

5.3.1 Ensure that Azure Admin Accounts Are Not Used for Daily Operations

Information

Microsoft Azure admin accounts should not be used for routine, non-administrative tasks.

Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

If admin accounts are being used for daily operations, consider the following:

 - Monitor and alert on unusual activity.
 - Enforce the principle of least privilege.
 - Revoke any unnecessary administrative access.
 - Use Conditional Access to limit access to resources.
 - Ensure that administrators have separate admin and user accounts.
 - Use Microsoft Entra ID Protection to detect, investigate, and remediate identity-based risks.
 - Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access.

Impact:

Minor administrative overhead includes managing separate accounts, enforcing stricter access controls, and potential licensing costs for advanced security features.

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: microsoft_azure

Control ID: ba1abe1d14f102682d0f9562572313a1728dff9a79d412c93aa901f3f1d14df7