Who is Owner in your Azure subscription?
Oct 19th, 2019 by Jesper Kråkhede
When I review an Azure environment one of the first things I check is who has the Owner role. Too often the list is long and includes consultants that left the project a long time ago.
Owner in Azure is Tier 0 for your cloud. It can do anything, including giving itself and others even more rights. Treat it like you treat your Domain Admins.
Some simple things to start with. Use management groups so rights and policies are set in one place and not per subscription. Give people the least role they need, Contributor or Reader is enough for most. Use Privileged Identity Management so the admin roles are activated when needed and expire by themselves. Keep two emergency accounts that are excluded from everything else, with long passwords stored in a safe, and monitor them so you know the second they are used. And turn on Azure Security Center and actually read the recommendations.
Last but not least: The admins should manage Azure from a PAW, not from the same laptop they read mail on. Your cloud is only as secure as the device that manages it.
The cloud doesn´t change the rules, it just makes the mistakes faster.