Azure overprovisioned identities should have only the necessary permissions

What does the recommendation "Azure overprovisioned identities should have only the necessary permissions" check?

Flags Azure RBAC assignments where an identity holds far more permissions than it has actually exercised, based on Defender for Cloud's agentless entitlement analysis of recent activity. It compares granted actions against used actions for users, service principals and managed identities, then surfaces the broadly scoped roles (typically Owner or Contributor) that could be narrowed. It is a CIEM finding within the Azure CSPM standard, not an Azure Policy assignment, so it only appears once the Defender CSPM plan and its Permissions Management (CIEM) toggle are enabled on the subscription. It does not cover identities that are completely inactive, which a separate recommendation handles, and it does not evaluate Microsoft Entra directory roles.

Why does "Azure overprovisioned identities should have only the necessary permissions" matter?

Every unused permission an identity carries is standing blast radius. If that account, key or token is phished or leaked, the attacker inherits the full grant, not just the handful of actions the workload genuinely needs, so an over-permissioned service principal can become subscription-wide compromise instead of a contained incident. Non-human identities are the sharpest case: they rarely change behaviour, so the gap between granted and used permissions is both wide and stable, and it is easy to measure. Right-sizing to least privilege shrinks what a single compromise can reach and makes anomalous activity easier to recognise, because the identity is no longer allowed to do things it never normally does.

How do I fix "Azure overprovisioned identities should have only the necessary permissions"?

1. Open the flagged identity in Defender for Cloud and review the permissions it has not used. Confirm the broad role assignment, for example an Owner or Contributor grant at subscription or resource group scope, with 'az role assignment list --assignee <objectId> --all -o table'.
2. Replace the broad built-in role with a least-privilege custom role covering only the actions the identity exercises. Author it from a definition file and assign it scoped tightly, for example 'az role definition create --role-definition rightsized-role.json' followed by 'az role assignment create --assignee <objectId> --role "<Custom Role Name>" --scope <resourceScope>', then remove the original assignment with 'az role assignment delete'.
3. For human administrators who occasionally need elevated rights, move standing access to just-in-time eligibility in Microsoft Entra Privileged Identity Management so the role is activated on request and time-boxed rather than always on.

# Find the highest-risk privileged assignments first: external accounts and blocked leavers holding Owner.
SUB="00000000-0000-0000-0000-000000000000"

# List Owners, with type and object id, so external and group principals are obvious.
az role assignment list \
  --scope "/subscriptions/$SUB" \
  --role Owner \
  --query "[].{who:principalName, type:principalType, id:principalId}" -o table

# Remove an external partner's Owner assignment (work finished). Keep at least one Owner you control.
az role assignment delete \
  --assignee "[email protected]" \
  --role Owner \
  --scope "/subscriptions/$SUB"

# Remove a deprecated (blocked) account's role assignment by object id.
# Blocking the Entra sign-in does NOT remove the assignment; delete it explicitly.
az role assignment delete \
  --assignee-object-id "<blocked-user-object-id>" \
  --scope "/subscriptions/$SUB"

# Consolidate the remaining legitimate Owners behind one Entra group, then make it eligible
# (just-in-time) via Privileged Identity Management so nobody holds standing Owner.