unauthorised subscription access using Api

Question

unauthorised subscription access using Api

Jusiah Katumba 41

Happened to see an authorized access to my pay as you go subscription .
they scheduled Microsoft.CostManagement/scheduledActions/dailyanomalybyresourcegroup

should i be worried of any malicious damage and how can i block them fro accessing my subscription

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Sadiqh Ahmed 49,571 Microsoft External Staff Moderator

@Jusiah Katumba Thank for contacting us and I apologize for the delayed response!

You mentioned that you noticed an unauthorized access on your Pay-As-You-Go subscription and wanted to know if the access can blocked.

This action "Microsoft.CostManagement/scheduledActions/dailyanomalybyresourcegroup" can only be performed by user who has appropriate access to the subscription. For example: The user must be an owner or contributor.
Doc references: Scheduled Actions - Create Or Update and Scheduled Actions - Delete

You might want to check what is your access level at the subscription as well as at directory level. Also check who else has "Owner" or "Contributor" access to the subscription.
Refer to - https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-roles-and-azure-ad-roles/ba-p/2363647

Update:
Was thinking perhaps i deploy a blueprint for billing and Global administrator. My only worry is wont it lock my colleagues out too. A read only policy.
-If you completely block all users then yes it does. You can use RBAC - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview to define required roles for each user to avoid unauthorized access to resources.

Hope this helps!

----------------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it

Jusiah Katumba 41 Reputation points

2022-05-19T11:53:32.113+00:00

@Sadiqh Ahmed Thank you for the response. Have gone through this and was thinking perhaps i deploy a blueprint for billing and Global administrator. My only worry is wont it lock my colleagues out too. A read only policy.
Sadiqh Ahmed 49,571 Reputation points Microsoft External Staff Moderator

2022-05-19T12:54:55.43+00:00

If you completely block all users then yes it does. You can use RBAC - https://learn.microsoft.com/en-us/azure/role-based-access-control/overview to define required roles for each user to avoid unauthorized access to resources.
Jusiah Katumba 41 Reputation points

2022-05-23T08:30:27.15+00:00

Hello when i move my virtual box intact to a new subscription is there a possibility of the unauthorized user accessing it again in the new subscription via inheritance. And how can i migrate without downtime if possible.Thanks
Sadiqh Ahmed 49,571 Reputation points Microsoft External Staff Moderator

2022-05-23T08:48:21.907+00:00

When move from one subscription to another, the RBAC roles needs to be re-created. That said, unauthorized user access to new subscription is not a possibility.

There will be no downtime for movement of subscription.

See the documentation for details - https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Share via

unauthorised subscription access using Api

When move from one subscription to another, the RBAC roles needs to be re-created. That said, unauthorized user access to new subscription is not a possibility.

There will be no downtime for movement of subscription.

0 additional answers

Your answer