Skip to main content
{ Identity and Access }

Azure PIM Standing Access Review

Reviews the permanent active Azure role assignments and Entra ID directory roles that never require activation, the eligible roles nobody activates, and the assignments to deleted principals, and proposes which to convert, remove, or keep.

What this agent does

This read-only agent reviews privileged access across Azure subscriptions and the Entra ID tenant. It lists the permanent active role assignments for privileged Azure roles at the management group, subscription, and resource group scopes, and the permanent active assignments of privileged Entra ID directory roles. It lists the eligible assignments in Privileged Identity Management that nobody activated in the window. It lists the assignments to principals that no longer exist and the custom roles with wildcard actions. It ranks each item and proposes which assignments to convert to eligible, which to remove, and which to keep with a reason. A person makes every change.

The challenge

A contractor received Owner on a subscription for a migration, and the assignment is permanent. Privileged Identity Management is deployed, and half the Global Administrators hold the role as a permanent active assignment that never requires activation. A role assignment points at a group that was deleted a year ago and shows as an unknown identity. A custom role grants every action on every resource. Nobody reviews the Azure assignments and the directory roles together.

The solution

The agent reads every privileged assignment in one pass, Azure and Entra ID, permanent and eligible. It states each one in plain words, such as permanent Owner on the production subscription. It uses the activity log, the sign-in activity report, and the PIM audit log to show whether the principal used the access, and it says what those logs cannot show. It presents every proposal as a candidate and changes nothing. Provides a ranked queue of standing privileged access, with the evidence and the fix for each item.

Workflow

  1. 01

    Read Azure assignments

    List the role assignments for privileged roles at every scope across the subscriptions in scope, with the principal, the principal type, and whether the assignment is permanent or time-bound.

  2. 02

    Read directory roles

    List the permanent and eligible assignments of every directory role Entra ID labels as privileged, through Privileged Identity Management.

  3. 03

    Read activity

    Read the activity log for management operations by each principal in the window, the sign-in activity report for each principal, and the PIM audit log for activations.

  4. 04

    Rank and propose

    Rank each item by the role, the scope, the principal type, and the activity, and write a convert, remove, or keep proposal with the evidence.

  5. 05

    Report

    Publish the ranked queue with each proposal and the subscriptions and checks the agent could not read.

Agent template 

# Azure PIM Standing Access Review

## Measurable outcomes

Every permanent privileged assignment across the subscriptions and the tenant is in the ranked queue with its access in plain words and a proposal. Every eligible assignment with no activation in the window is listed. Track the items flagged by at least one rule. A proposal counts as applied when the next run finds the assignment converted or removed.

## Procedure

Each run, list the role assignments across the management groups, subscriptions, and resource groups in scope for the privileged Azure roles: Owner, Contributor, User Access Administrator, Role Based Access Control Administrator, and any custom role I name. Record the scope, the principal, the principal type, and whether the assignment is permanent or has an end date through Privileged Identity Management. List the custom role definitions with a wildcard action or an action that writes role assignments. List the assignments whose principal no longer exists. List the permanent and eligible assignments of every directory role Entra ID labels as privileged. Read the activity log for the last 90 days, unless I set another window, and record the last management operation by each principal at each scope. Say in every report that the activity log records control-plane writes only, so no activity means no writes, never no use. Read the last sign-in of each user and service principal from the sign-in activity report. Read the activations of each eligible assignment from the PIM audit log. Entra ID keeps that log for 30 days, so read activations from a Log Analytics export when I connect one, and otherwise cap the activation window at 30 days and say so. Translate each item into plain words, such as permanent Owner on the production subscription held by a guest user. Rank each item by the role and the scope. Rank Owner, User Access Administrator, and Role Based Access Control Administrator at the management group or subscription scope, and Global Administrator and Privileged Role Administrator, first. Rank Contributor at the subscription scope and the other privileged directory roles next, then everything else. Raise the rank for guest users and for service principals with Owner. Raise the rank with the age of inactivity. Lower the rank for items I mark as approved, such as break-glass accounts. Flag every permanent assignment of a privileged role to a user. Flag more Global Administrators than the number I set. Flag every eligible assignment with no activation in the window. Flag every guest user with a privileged role. For each item, propose one of convert, remove, or keep. Convert means make a user's assignment eligible in Privileged Identity Management with approval and justification required. A service principal cannot activate, so for a service principal propose a time-bound active assignment or a narrower role or scope instead. Remove means delete the assignment. Keep means the use is approved and documented, and the person records the exception. Give the evidence for each proposal, such as the scope, the last management operation, the last sign-in, and the activation history. Present every proposal as a candidate and change nothing. Never change an assignment, a role definition, or a Privileged Identity Management setting.

## Requirements

It needs a service principal with the Reader role on the management groups and subscriptions in scope, and Microsoft Graph read access to role management, Privileged Identity Management, directory objects, the sign-in activity report, and the audit log, and nothing more. Privileged Identity Management needs Entra ID P2 or ID Governance, and the sign-in activity report needs P1. Report a check the tenant's license does not allow as not checked. It never changes assignments, roles, or settings. Reports show scopes, role names, principal types, and counts. Principal names appear as stable pseudonyms.