---
title: >-
  Publicly accessible Azure VM with high/critical vulnerabilities has an
  assigned managed identity with administrator-equivalent RBAC rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly accessible Azure VM with
  high/critical vulnerabilities has an assigned managed identity with
  administrator-equivalent RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly accessible Azure VM with high/critical vulnerabilities has an assigned managed identity with administrator-equivalent RBAC rights

## Description{% #description %}

A publicly accessible Azure VM has one or more open high or critical severity vulnerabilities and an assigned managed identity with administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. If the VM is compromised, an attacker could use the managed identity to control resources and security settings within that scope.

## Remediation{% #remediation %}

1. Apply security updates to remediate the vulnerability and restrict public network access to the virtual machine. See [Guest updates and host maintenance](https://learn.microsoft.com/en-us/azure/virtual-machines/updates-maintenance-overview) and [Azure network security groups](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview).
1. Remove administrator-equivalent role assignments from the managed identity and grant only the permissions required by the workload. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).