AZ_USER_ACCESS_ADMINISTRATOR

Summary

Forestall ACL Alias	AZ_USER_ACCESS_ADMINISTRATOR
Azure Alias	User Access Administrator (Azure RBAC)
Affected Object Types	Subscriptions, Management Groups, Resource Groups, Resources
Exploitation Certainty	Certain
Azure RBAC Role	User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9) - manage user access to Azure resources

Description

AZ_USER_ACCESS_ADMINISTRATOR represents the Azure RBAC User Access Administrator role assignment. This role grants the ability to manage role assignments at the assigned scope, enabling direct privilege escalation to any role including Owner.

Key capabilities:

• Read/write role assignments - create, update, delete role assignments at the scope.

• Cannot manage resources directly - unlike Owner or Contributor, this role has no resource management permissions.

• Focused on access control - purpose-built for delegating access management.

The User Access Administrator role is explicitly designed for privilege escalation - its entire purpose is to grant access to resources. This makes it an extremely high-value target.

Comparison	Owner	User Access Administrator	Contributor
Manage resources	Yes	No	Yes
Assign roles	Yes	Yes	No
Modify role definitions	Yes	No	No

Attack Path: User Access Administrator -> Self-assign Owner -> Full subscription control

Identification

PowerShell (Az Module)

Connect-AzAccount

# List all User Access Administrator assignments
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Check subscription-level assignments (most dangerous)
Get-AzRoleAssignment -RoleDefinitionName "User Access Administrator" `
    -Scope "/subscriptions/<SubscriptionId>" |
    Select-Object DisplayName, SignInName, ObjectType |
    Format-Table -AutoSize

Azure CLI

# List all User Access Administrator assignments
az role assignment list --role "User Access Administrator" -o table

# List at subscription scope
az role assignment list --role "User Access Administrator" --scope "/subscriptions/<SubscriptionId>" -o table

Azure Portal

1. Open Azure Portal -> Subscriptions (or target scope).

2. Go to Access control (IAM) -> Role assignments.

3. Filter by Role = User Access Administrator.

4. Review all principals - these can escalate to Owner.

Exploitation

The User Access Administrator role grants Microsoft.Authorization/roleAssignments/write, enabling direct privilege escalation by assigning any role (including Owner) to any principal.

Related Attack Paths:

• AZ_ASSIGN_ROLES - User Access Administrator can assign any Azure RBAC role, including Owner, to any principal.

Mitigation

1. Minimize User Access Administrator assignments

   • This role should be assigned only to identities that specifically need to manage access.

   • Consider whether Role Based Access Control Administrator with conditions is more appropriate.

2. Use Privileged Identity Management (PIM)

   • Configure eligible (not permanent) assignments.

   • Require approval and MFA for activation.

   • Use time-bound assignments.

3. Scope narrowly

   • Assign at resource group or resource level rather than subscription level where possible.

4. Use RBAC conditions

   • Apply conditions to constrain which roles can be assigned and to whom.

   • The Role Based Access Control Administrator role supports conditions by default.

5. Monitor closely

   • Alert on all User Access Administrator assignments.

   • Alert on all role assignments made by User Access Administrators.

Detection

Use the Azure Portal:

1. Open Azure Portal -> Monitor -> Activity Log.

2. Filter by Operation name = Create role assignment or Delete role assignment.

3. Review the Caller and Target Resource to identify who made role assignment changes and what was assigned.

4. For subscription-level view: Go to Subscriptions -> select subscription -> Activity log -> filter for Microsoft.Authorization/roleAssignments/write.

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

• https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

• https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview