Least privilege limits access to only the permissions required for a task and only for the time they are needed. It reduces the potential impact of compromised identities and supports zero trust, which verifies every request and assumes breach. section 1.7
Apply least privilege by:
- Assigning only the Azure RBAC permissions required for a role. section 2.14
- Granting privileged access temporarily and reviewing it regularly with Privileged Identity Management and access reviews. section 2.14
- Choosing the narrowest practical scope for each assignment rather than granting access across an entire management group or subscription. section 5.1.2
- Combining least privilege with explicit verification, monitoring, and other layers of defense rather than treating it as a complete security solution. section 1.7 section 2.14
Azure Storage control-plane access
For Azure Storage control-plane operations, assign an appropriate role at the storage-account scope when possible. A Reader can view resources without accessing account keys; User Access Administrator can assign permissions, while Virtual Machine Contributor can manage virtual machines but not their connected storage resources. Treat roles that can list storage-account keys as highly sensitive because those keys can provide data access. section 5.1.2
