Control: 5.3.6 Ensure 'Tenant Creator' role assignments are periodically reviewed
Description
Perform a periodic review of the Tenant Creator role assignment to ensure that the assignments are accurate and appropriate.
This recommendation should be applied alongside the recommendation "Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'".
Unnecessary assignments increase the risk of privilege escalation and unauthorized access.
Remediation
Remediate from Azure Portal
- Go to
Microsoft Entra ID. - Under
Manage, clickRoles and administrators. - In the search bar, type
Tenant Creator. - Click the role.
- Click the name of an assignment.
- Check the box next to the
Tenant Creatorrole. - Click
X Remove assignments. - Click
Yes. - Repeat steps 1-8 for each assignment requiring remediation.
Default Value
The Tenant Creator role is not assigned by default.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_3_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_3_6 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;