Skip to content
Forestall

AZ_USER_ACCESS_ADMINISTRATOR

Copy page

Summary
Forestall ACL Alias AZ_USER_ACCESS_ADMINISTRATOR
Azure Alias User Access Administrator (Azure RBAC)
Affected Object Types Subscriptions, Management Groups, Resource Groups, Resources
Exploitation Certainty Certain
Azure RBAC Role User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9) - manage user access to Azure resources

Description

AZ_USER_ACCESS_ADMINISTRATOR represents the Azure RBAC User Access Administrator role assignment. This role grants the ability to manage role assignments at the assigned scope, enabling direct privilege escalation to any role including Owner.

Key capabilities:

  • Read/write role assignments - create, update, delete role assignments at the scope.
  • Cannot manage resources directly - unlike Owner or Contributor, this role has no resource management permissions.
  • Focused on access control - purpose-built for delegating access management.

The User Access Administrator role is explicitly designed for privilege escalation - its entire purpose is to grant access to resources. This makes it an extremely high-value target.

Comparison Owner User Access Administrator Contributor
Manage resources Yes No Yes
Assign roles Yes Yes No
Modify role definitions Yes No No

Attack Path: User Access Administrator -> Self-assign Owner -> Full subscription control

Identification

PowerShell (Az Module)

Connect-AzAccount


# List all User Access Administrator assignments
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize


# Check subscription-level assignments (most dangerous)
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" `
    -Scope "/subscriptions/<SubscriptionId>" |
    Select-Object DisplayName, SignInName, ObjectType |
    Format-Table -AutoSize

Exploitation

The User Access Administrator role grants Microsoft.Authorization/roleAssignments/write, enabling direct privilege escalation by assigning any role (including Owner) to any principal.

Related Attack Paths:

  • AZ_ASSIGN_ROLES - User Access Administrator can assign any Azure RBAC role, including Owner, to any principal.

Mitigation

  1. Minimize User Access Administrator assignments

    • This role should be assigned only to identities that specifically need to manage access.
    • Consider whether Role Based Access Control Administrator with conditions is more appropriate.

  2. Use Privileged Identity Management (PIM)

    • Configure eligible (not permanent) assignments.
    • Require approval and MFA for activation.
    • Use time-bound assignments.

  3. Scope narrowly

    • Assign at resource group or resource level rather than subscription level where possible.

  4. Use RBAC conditions

    • Apply conditions to constrain which roles can be assigned and to whom.
    • The Role Based Access Control Administrator role supports conditions by default.

  5. Monitor closely

    • Alert on all User Access Administrator assignments.
    • Alert on all role assignments made by User Access Administrators.

Detection

Use the Azure Portal:

  1. Open Azure Portal -> Monitor -> Activity Log.
  2. Filter by Operation name = Create role assignment or Delete role assignment.
  3. Review the Caller and Target Resource to identify who made role assignment changes and what was assigned.
  4. For subscription-level view: Go to Subscriptions -> select subscription -> Activity log -> filter for Microsoft.Authorization/roleAssignments/write.

References

Was this page helpful?

Thank you for your feedback.