Deprecated accounts with owner permissions should be removed from subscriptions

What does the recommendation "Deprecated accounts with owner permissions should be removed from subscriptions" check?

Flags any subscription that still has an Owner role assignment held by a deprecated account: a user that Microsoft Entra ID reports as blocked from signing in, or one that no longer exists in the directory but whose role assignment was never cleaned up. The scope is deliberately narrow. It looks only at the built-in Owner role at subscription scope, so a deprecated account that holds Contributor, User Access Administrator or a resource-group assignment is caught by the broader 'deprecated accounts should be removed' recommendation instead, not this one. It also does not flag active, sign-in-enabled owners, however excessive their access, and it does not evaluate service principals or managed identities, only human user objects.

Why does "Deprecated accounts with owner permissions should be removed from subscriptions" matter?

An Owner assignment grants full control of the subscription, including the right to grant access to others. A blocked or orphaned account holding that role is a credential nobody is watching: if its password or token is recovered, or if a deleted user object is recreated with the same name and inherits the dangling assignment, an attacker gains the highest level of access and can do so without tripping the alerts that watch your day-to-day staff. Because the account is dormant, the misuse is unlikely to be noticed for weeks. Removing it closes a standing privileged backdoor and keeps your owner inventory honest, which is what auditors and incident responders actually rely on.

How do I fix "Deprecated accounts with owner permissions should be removed from subscriptions"?

1. Confirm the account is genuinely deprecated: run 'az ad user show --id <upn-or-object-id> --query accountEnabled' to check it is disabled, or expect a not-found error if the object is already deleted from the directory.
2. List the Owner assignments on the subscription with 'az role assignment list --scope /subscriptions/<sub-id> --role Owner -o table', confirm at least one active owner remains, then remove the stale one with 'az role assignment delete --assignee <object-id> --role Owner --scope /subscriptions/<sub-id>'.
3. Where the directory object is itself dead, delete it with 'az ad user delete --id <object-id>' so the same identity cannot be recreated and silently reinherit access, and add Entra ID access reviews so disabled accounts lose role assignments automatically in future.

# Remove the highest-impact stale grants first: external/guest identities holding Owner.
SCOPE="/subscriptions/00000000-0000-0000-0000-000000000000"
az role assignment list --scope "$SCOPE" --all --include-inherited \
    --query "[?contains(principalName, '#EXT#') && roleDefinitionName=='Owner'].principalId" -o tsv |
while read -r oid; do
  az role assignment delete --assignee-object-id "$oid" --scope "$SCOPE"
  echo "$oid: external Owner assignment removed"
done

# Find blocked/deprecated (disabled) accounts that still hold a role on this scope.
for oid in $(az role assignment list --scope "$SCOPE" --all \
    --query "[?principalType=='User'].principalId" -o tsv | sort -u); do
  enabled=$(az ad user show --id "$oid" --query accountEnabled -o tsv 2>/dev/null)
  if [ "$enabled" = "false" ]; then
    echo "$oid is disabled in Entra but still holds a role - remove its assignment"
  fi
done

# Keep it shut: assign the built-in deprecated-owner policy by its exact display name
# (look the id up at runtime - never hardcode a policy GUID).
pid=$(az policy definition list \
  --query "[?displayName=='Deprecated accounts with owner permissions should be removed from your subscription'].name" -o tsv)
az policy assignment create \
  --name audit-deprecated-owners \
  --policy "$pid" \
  --scope "$SCOPE"