> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_user_access_administrator.md).

# AZ\_USER\_ACCESS\_ADMINISTRATOR

## Summary

|                            |                                                                                                            |
| -------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_USER\_ACCESS\_ADMINISTRATOR                                                                            |
| **Azure Alias**            | User Access Administrator (Azure RBAC)                                                                     |
| **Affected Object Types**  | Subscriptions, Management Groups, Resource Groups, Resources                                               |
| **Exploitation Certainty** | Certain                                                                                                    |
| **Azure RBAC Role**        | User Access Administrator (`18d7d88d-d35e-4fb5-a5c3-7773c20a72d9`) - manage user access to Azure resources |

## Description

`AZ_USER_ACCESS_ADMINISTRATOR` represents the Azure RBAC **User Access Administrator** role assignment. This role grants the ability to **manage role assignments** at the assigned scope, enabling direct privilege escalation to any role including Owner.

Key capabilities:

* **Read/write role assignments** - create, update, delete role assignments at the scope.
* **Cannot manage resources directly** - unlike Owner or Contributor, this role has no resource management permissions.
* **Focused on access control** - purpose-built for delegating access management.

The User Access Administrator role is **explicitly designed for privilege escalation** - its entire purpose is to grant access to resources. This makes it an extremely high-value target.

| Comparison              | Owner | User Access Administrator | Contributor |
| ----------------------- | ----- | ------------------------- | ----------- |
| Manage resources        | Yes   | **No**                    | Yes         |
| Assign roles            | Yes   | **Yes**                   | No          |
| Modify role definitions | Yes   | No                        | No          |

> **Attack Path:** User Access Administrator -> Self-assign Owner -> Full subscription control

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List all User Access Administrator assignments
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Check subscription-level assignments (most dangerous)
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" `
    -Scope "/subscriptions/<SubscriptionId>" |
    Select-Object DisplayName, SignInName, ObjectType |
    Format-Table -AutoSize
```

### Azure CLI

```bash
# List all User Access Administrator assignments
az role assignment list --role "User Access Administrator" -o table

# List at subscription scope
az role assignment list --role "User Access Administrator" --scope "/subscriptions/<SubscriptionId>" -o table
```

### Azure Portal

1. Open **Azure Portal** -> **Subscriptions** (or target scope).
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter by **Role = User Access Administrator**.
4. Review all principals - these can escalate to Owner.

## Exploitation

The User Access Administrator role grants `Microsoft.Authorization/roleAssignments/write`, enabling direct privilege escalation by assigning any role (including Owner) to any principal.

> **Related Attack Paths:**
>
> * [AZ\_ASSIGN\_ROLES](https://docs.forestall.io/fsprotect/edges/azure/az_assign_roles) - User Access Administrator can assign any Azure RBAC role, including Owner, to any principal.

## Mitigation

1. **Minimize User Access Administrator assignments**
   * This role should be assigned only to identities that specifically need to manage access.
   * Consider whether **Role Based Access Control Administrator** with conditions is more appropriate.
2. **Use Privileged Identity Management (PIM)**
   * Configure eligible (not permanent) assignments.
   * Require approval and MFA for activation.
   * Use time-bound assignments.
3. **Scope narrowly**
   * Assign at resource group or resource level rather than subscription level where possible.
4. **Use RBAC conditions**
   * Apply conditions to constrain which roles can be assigned and to whom.
   * The **Role Based Access Control Administrator** role supports conditions by default.
5. **Monitor closely**
   * Alert on all User Access Administrator assignments.
   * Alert on all role assignments made by User Access Administrators.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> **Monitor** -> **Activity Log**.
2. Filter by **Operation name** = `Create role assignment` or `Delete role assignment`.
3. Review the **Caller** and **Target Resource** to identify who made role assignment changes and what was assigned.
4. For subscription-level view: Go to **Subscriptions** -> select subscription -> **Activity log** -> filter for `Microsoft.Authorization/roleAssignments/write`.

## References

* <https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal>
* <https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview>