Control: 6.3.1 Ensure that Azure admin accounts are not used for daily operations

Description

Microsoft Azure admin accounts should not be used for routine, non-administrative tasks.

Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.

If admin accounts are being used for daily operations, consider the following:

Monitor and alert on unusual activity.
Enforce the principle of least privilege.
Revoke any unnecessary administrative access.
Use Conditional Access to limit access to resources.
Ensure that administrators have separate admin and user accounts.
Use Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks.
Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access.

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v400_6_3_1

powerpipe login
powerpipe control run azure_compliance.control.cis_v400_6_3_1 --share

This control uses a named query:

select
  id as resource,
  'info' as status,
  'Manual verification required.' as reason,
  display_name as subscription
from
  azure_subscription;