Azure subscription Owner is an access-delegation privilege

You hand someone the Owner role on an Azure subscription.

You think you're giving them the keys to manage resources. VMs, databases, networking. You think you've made them a builder.

You look at the role name. "Owner." It sounds like they just own the stuff inside the box.

They don't. They own the box. And they own the locks.

It’s not tenant-wide administration. A subscription Owner isn't a Global Administrator. They can't rewrite the rules for the entire Azure tenant. They can't even remove protected deny assignments if someone locked a resource down properly.

But they don't need to.

Because within the boundary of that subscription, Owner is an access-delegation privilege.

They can assign powerful data-access roles. They can hand out the keys to the data plane. They can change legacy Key Vault access policies. They can grant someone else the right to read the secrets, even if they themselves were never explicitly granted that data access.

The control plane becomes a backdoor to the data plane.

We treat subscription management and data access as two different conversations.

They aren't.

If you want to protect your data, you need to look at who holds the Owner role. Review who can assign those powerful data-access roles. Review who can quietly flip a legacy Key Vault access policy to let themselves in.

When that Owner grant was approved, what was the justification? "Needs to manage the dev environment." "Needs to deploy the infrastructure."

But was the grant approved with those delegation powers in view?

If not, you haven't granted resource administration.

You have granted data access. And you didn't even realize it.