Azure subscriptions should have between 2 and 3 owners
Powerpipe check iam_subscription_owner_between_2_and_3 is titled "Ensure there are between 2 and 3 subscription owners". The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.
The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.
What this control checks
Subscription must have between 2 and 3 owners (Owner role in Azure grants full control).
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_subscription_owners_between_2_and_3 (prowler azure --checks iam_subscription_owners_between_2_and_3); PowerPipe control azure_compliance.control.iam_subscription_owner_between_2_and_3.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.27 (Ensure there are between 2 and 3 subscription owners).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.27 Ensure there are between 2 and 3 subscription owners
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscription_owner_between_2_and_3 - Powerpipe Control:
azure_compliance.control.iam_subscription_owner_between_2_and_3 - Prowler Check:
iam_subscription_owners_between_2_and_3
Last reviewed: 2026-10-13