Description

Detects Azure subscriptions that have fewer than two owners assigned. Having only one subscription owner creates a single point of failure and administrative access risk if that owner becomes unavailable or their credentials are compromised.

Detection Strategy

• Checks the list of role assignments for the Azure subscription

• Filters to only include User principal types (excluding service principals and groups)

• Counts the number of unique users with Owner role assignments

• Reports a vulnerability if fewer than 2 users have Owner role permissions on the subscription