A maximum of 3 owners should be designated for subscriptions

What does this mean?

Having too many subscription Owners increases the risk of compromise through a breached account. This recommendation limits the Owner role to a maximum of 3 users to minimize the attack surface while ensuring business continuity.

The Owner role grants full control over all resources within a subscription, including the ability to assign roles to others. Because of this elevated privilege level, it should be tightly controlled and assigned only when strictly necessary.

Benefits of implementation

• Reduces the number of accounts with full administrative privileges
• Limits the blast radius of account compromise
• Required by CIS Benchmark and MCSB
• Enforces the principle of least privilege
• Improves governance and role clarity
• Required by CIS Benchmark and Microsoft Cloud Security Benchmark (MCSB)

Drawbacks and considerations

• May be too restrictive for organizations with complex management structures
• Requires clear escalation procedures when Owners are unavailable
• Break-glass accounts must be carefully managed
• Requires monitoring to prevent privilege creep over time

Implementation

1. Identify current Owners

• Review all users and service principals assigned the Owner role at the subscription level.
• Document business justification for each assignment.

2. Reduce Owner assignments

• Limit the Owner role to a maximum of three individual users.
• Remove unnecessary assignments.
• Replace permanent assignments with role-based alternatives where possible (e.g., Contributor + User Access Administrator if appropriate).

3. Implement Privileged Identity Management (Recommended)

• Use Microsoft Entra ID Privileged Identity Management (PIM) to:
• Make Owner assignments eligible instead of permanent
• Require justification and approval
• Enforce MFA
• Set activation time limits

4. Define emergency access (break-glass)

• Maintain 1–2 emergency access accounts:
• Cloud-only accounts
• Excluded from Conditional Access policies that could cause lockout
• Protected with strong authentication methods
• Regularly tested and monitored

5. Monitor continuously

• Set up alerts for:
• New Owner role assignments
• Privileged role activation
• Perform quarterly access reviews

Related recommendations

Related recommendations will be linked here.