# Ensure all IAM policies granting manage/use on groups or users in the tenancy restrict access to the Administrators group

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698516161458-ensure-all-iam-policies-granting-manageuse-on-groups-or-users-in-the-tenancy-restrict-access-to-the-administrators-group
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure policy statements that grant manage or use on users or groups at the tenancy level are given only to the Administrators group. If another group, such as a user management team, needs these permissions, the statement must include a condition that stops it from changing the Administrators group.

**Rationale**

Permission to manage users or groups lets a person add themselves or others to any group, including Administrators. This is a direct path to taking over the tenancy. Restricting these permissions to the Administrators group, or adding a condition that protects the Administrators group, prevents unauthorized privilege escalation.

**Impact**

-   Prevents non-admins from adding themselves to Administrators
    
-   Protects the Administrators group membership
    
-   User management teams need a restricted condition in their policies
    

**Default Value**

By default, only the Tenant Admin Policy grants these permissions, through manage all-resources for the Administrators group.

**Pre-Requisites**

-   Tenancy administrator access
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Review each policy for statements that grant manage users, manage groups, use users, or use groups in tenancy.
    
4.  Flag any such statement granted to a group other than Administrators without a condition protecting the Administrators group.
    
5.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the flagged policy and select Edit policy statements.
    
4.  Remove the statement, or add a condition that protects the Administrators group, for example: Allow group UserAdmins to use groups in tenancy where target.group.name != 'Administrators'
    
5.  Select Save changes.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the policy, select Edit policy statements, restore the previous statement, and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/iampolicyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/iampolicyreference.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam\_security.htm](https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam_security.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.