Azure subscriptions should have more than one owner
It is recommended to designate more than one subscription owner in order to have administrator access redundancy. The Azure Policy check audits resources of type `Microsoft.Resources/subscriptions`. The Powerpipe check carries the same title.
It is recommended to designate more than one subscription owner in order to have administrator access redundancy.
What this control checks
There should be more than one owner assigned to your subscription
Common pitfalls
Owner role can manage everything and assign roles
The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others.
effect only allows AuditIfNotExists or Disabled
The effect parameter defaults to AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "There should be more than one owner assigned to your subscription" (09024ccc-0c5f-475e-9457-b7c0d9ed487b); Prowler check iam_subscription_owners_between_2_and_3 (prowler azure --checks iam_subscription_owners_between_2_and_3); PowerPipe controls azure_compliance.control.iam_subscription_owner_between_2_and_3 and azure_compliance.control.iam_subscription_owner_more_than_1.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-5 (Separation of Duties).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-02 (Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk...).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-5 (Separation Of Duties).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-5 Separation of Duties
NIST Cybersecurity Framework v2.0
- GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered.
FedRAMP Moderate Baseline Rev 4
- AC-5 Separation Of Duties
- 3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- 5.27 Ensure there are between 2 and 3 subscription owners
- 3.1.c Role based Access Control
- AC.L2-3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion
- AC-5 Separation Of Duties
- 1145.01c2System.1-01.c 01.02 Authorized Access to Information Systems
- 1152.01c3System.2-01.c 01.02 Authorized Access to Information Systems
- 7.1.1: Define access needs for each role, including: - System components and data resources that each role needs to access for their job function - Level of privilege required (for example, user, administrator, etc.) for accessing resources.
- 7.1.3: Assign access based on individual personnel's job classification and function.
- Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_subscription_owner_more_than_1 - Powerpipe Controls:
azure_compliance.control.iam_subscription_owner_between_2_and_3,azure_compliance.control.iam_subscription_owner_more_than_1 - Prowler Check:
iam_subscription_owners_between_2_and_3 - Azure Policy Definition:
09024ccc-0c5f-475e-9457-b7c0d9ed487b
Last reviewed: 2026-10-13