Role assignments should not grant the User Access Administrator role at root scope

azure-active-directory
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

The User Access Administrator role grants the ability to manage access to all Azure resources. When assigned at root scope (/), this privilege extends across every management group, subscription, and resource in the tenant. Assigning this role at root scope creates an elevated attack surface: any compromise or misuse of such an account could allow RBAC changes across the entire tenant. This assignment should be reserved for break-glass scenarios and removed once the task is complete.

Remediation

Remove any User Access Administrator role assignments scoped to / that are not required. Use the Azure portal under Microsoft Entra ID > Properties > Access management for Azure resources, or remove assignments directly in Subscriptions > Access control (IAM). See Elevate access to manage all Azure subscriptions and management groups.