---
title: >-
  Azure user-assigned managed identity trusts an external OIDC issuer and has
  administrator-equivalent RBAC rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure user-assigned managed identity
  trusts an external OIDC issuer and has administrator-equivalent RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure user-assigned managed identity trusts an external OIDC issuer and has administrator-equivalent RBAC rights

## Description{% #description %}

An Azure user-assigned managed identity has a federated identity credential that trusts an OIDC issuer associated with another Microsoft Entra tenant or a non-Entra identity provider, and its service principal has administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. An attacker who can obtain a matching token from the external issuer could exchange it for an Azure access token and use the managed identity's administrative permissions.

An issuer is considered external when it is outside the identity's Microsoft Entra tenant, even if your organization owns or manages the workloads using it. The finding identifies external federation combined with administrative permissions or a privilege-escalation path; it does not establish whether that federation is expected.

## Remediation{% #remediation %}

1. Verify that the federated identity credential's issuer, subject, and audience are expected. Delete the credential if the external trust is unnecessary. See [Configure a user-assigned managed identity to trust an external identity provider](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-create-trust-user-assigned-managed-identity).
1. Remove administrator-equivalent role assignments from the managed identity and grant only the permissions required by the workload. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).