External accounts with owner permissions should be removed from subscriptions

What does the recommendation "External accounts with owner permissions should be removed from subscriptions" check?

Flags any account holding the Owner role on a subscription whose identity lives outside your Microsoft Entra tenant, meaning the sign-in domain does not match your directory. These are typically guest (B2B) users, partner or contractor logins, and accounts left behind from a former company domain after a merger or rebrand. It only looks at the Owner role and only at the subscription scope. It does not flag external accounts with Contributor or other roles, internal employees who hold Owner, or external accounts scoped to a single resource group or resource. Note that classic subscription administrator assignments are treated as part of the Owner role here. Sibling recommendations cover the write and read permission variants.

Why does "External accounts with owner permissions should be removed from subscriptions" matter?

Owner is the most powerful role in a subscription: it can grant roles to anyone, read every secret, and delete or exfiltrate any resource. An external identity holding it sits outside your own joiner-mover-leaver process, so when a contract ends or a partner relationship lapses, the account often stays live and unmonitored because no one on your side owns its lifecycle. If that external tenant is breached, or a single external admin is phished, the attacker inherits full control of your subscription with no further privilege escalation needed. The business consequence is a complete loss of control over billing, data and resources that you cannot quickly revoke, since you do not administer the foreign directory. Removing external Owners shrinks the blast radius to identities your own directory governs and can disable on day one.

How do I fix "External accounts with owner permissions should be removed from subscriptions"?

1. In the Azure portal open the subscription's Access control (IAM) blade, filter role assignments to Owner, and identify each assignee whose domain is not your tenant; confirm with the business whether that access is still required before removing it.
2. Remove the assignment with 'az role assignment delete --assignee <objectId> --role Owner --scope /subscriptions/<subId>', or revoke it via the portal. If the external party genuinely needs standing access, grant the least-privileged role that fits (often Contributor or a custom role) rather than Owner.
3. Where occasional elevated access is justified, replace the permanent assignment with an eligible, time-bound Owner assignment in Microsoft Entra Privileged Identity Management, requiring approval and MFA at activation so the access is just-in-time rather than always-on.

# Find the highest-risk privileged assignments first: external accounts and blocked leavers holding Owner.
SUB="00000000-0000-0000-0000-000000000000"

# List Owners, with type and object id, so external and group principals are obvious.
az role assignment list \
  --scope "/subscriptions/$SUB" \
  --role Owner \
  --query "[].{who:principalName, type:principalType, id:principalId}" -o table

# Remove an external partner's Owner assignment (work finished). Keep at least one Owner you control.
az role assignment delete \
  --assignee "[email protected]" \
  --role Owner \
  --scope "/subscriptions/$SUB"

# Remove a deprecated (blocked) account's role assignment by object id.
# Blocking the Entra sign-in does NOT remove the assignment; delete it explicitly.
az role assignment delete \
  --assignee-object-id "<blocked-user-object-id>" \
  --scope "/subscriptions/$SUB"

# Consolidate the remaining legitimate Owners behind one Entra group, then make it eligible
# (just-in-time) via Privileged Identity Management so nobody holds standing Owner.