Why this matters
Azure checks permissions in two places. Microsoft Entra ID controls directory objects such as users, groups, apps and administrative roles. Azure RBAC controls resources such as subscriptions, resource groups, virtual machines and storage accounts. A person can be a Reader in Azure and still reset passwords if their Entra role allows it, or the reverse. Least privilege means fixing both sides.
Most Azure access drifts because role assignments inherit down the scope tree. An Owner assignment at a management group reaches every subscription below it. A Contributor at a subscription reaches every resource group. People add the broad assignment once to unblock a task, then forget it. The same thing happens to service principals and managed identities, which often keep secrets and broad roles long after the deployment.
Workload identities make this more urgent. A service principal with Contributor at subscription level can change anything if its secret leaks. A managed identity with the same role can do the same from any workload that can request a token. Removing standing access and narrowing scope limits what an attacker or a mistaken script can touch. It also makes access reviews shorter.
Before you start
Get the right administrators in the room. To change Entra directory roles you need Privileged Role Administrator or Global Administrator. To change Azure resource roles you need Owner or User Access Administrator at the scope you are changing. A read-only export first is safer.
Export the current role assignments. In the Azure portal open each subscription, then Access control (IAM), then Role assignments, and download the CSV. For a wider view use Azure Resource Graph or PowerShell with Get-AzRoleAssignment and az role assignment list --all. For Entra roles use Microsoft Graph PowerShell, for example Get-MgDirectoryRole and Get-MgRoleManagementDirectoryRoleAssignment.
List the workload identities before you touch user access. In the Entra admin center open Applications, then Enterprise applications, and review owners, credentials and assigned Azure roles. Include managed identities under Identity, then Managed identities. Ask which deployment or job owns each one.
Check licensing early. PIM needs Microsoft Entra ID P2 for the users who activate roles. Access reviews need the right Entra ID Governance or PIM licensing. If you do not have it, plan manual checks instead. Do not promise a process the tenant cannot run.
How to do it
Work from the top of the scope tree down. Fix management group and subscription assignments before resource group assignments, because a broad assignment at the top defeats careful work below it. For each assignment ask two questions: who needs it, and at what scope does the job stop working if the scope is smaller?
Separate people from workloads. Put people in Entra security groups and assign Azure roles to those groups. Give each application its own managed identity or service principal, and grant only the data actions it calls. Use PIM for roles that are needed occasionally, with approval and a short activation window.
Do these steps in a test subscription first if you can. Keep a second administrator available to restore access if a change locks someone out.
- Map each role assignment to a job. For every assignment in your export, write down the task it supports and the owner. If nobody can name the task, mark it for removal. Group the results by person, group and workload identity.
- Replace broad scopes with narrow ones. Move assignments from management group or subscription scope to the resource group or resource that needs them. Remove the broad assignment only after the narrow one is tested. Check inherited assignments before you add a new one.
- Assign roles to security groups. Create Entra security groups for each job role and assign Azure roles to the group. Add people to the group instead of assigning roles to their user account. Review group membership on a set schedule.
- Make privileged roles eligible in PIM. In Privileged Identity Management, change standing Owner, Contributor and User Access Administrator assignments to eligible where the work is occasional. Require justification, approval and a short maximum duration. Keep permanent active assignments only where an automated process truly needs them.
- Remove secrets from service principals. Move workloads to managed identities or workload identity federation where the platform supports it. Delete unused secrets and certificates from app registrations. Give each application its own identity instead of sharing one across jobs.
- Trim custom roles and data actions. Review custom role definitions for wildcard actions and wide AssignableScopes. Replace wildcards with the exact actions the job calls. Add data actions only for the resources that need them, then test the role with a non-admin account.
- Schedule access reviews and cleanup. Set recurring access reviews for privileged groups and workload identities. Use PIM audit history and sign-in logs to find assignments nobody uses. Remove the assignment or let the review expire it.
How to check it worked
Use Check access in Access control (IAM) for a sample of users and groups. Pick a person who should have Reader on one resource group and confirm they cannot see another subscription. Then sign in as that test user and try the task they are meant to do, plus one task they should not be able to do.
Run the export again and compare it with the baseline. Look for Owner and Contributor at subscription or management group scope, role assignments to individual users, and active PIM assignments that should be eligible. In PIM, open Audit history to confirm activations have approval, justification and an end time.
Check the workload side separately. Open Enterprise applications and look at sign-in logs for each service principal. Confirm the app still works after you remove a secret or narrow a role. For managed identities, check the resource identity blade and the role assignments at its scope. If an access review is running, track completion and remove access that reviewers did not approve.
Mistakes to avoid
Assigning Owner because it is easy. Owner can manage access, so it can create new owners. Use Contributor or a narrower custom role when the person only needs to change resources, and use User Access Administrator only for access changes. Leaving PIM assignments active is another common miss. An eligible assignment that stays active all week is standing access with extra steps. Set a maximum activation duration and require approval for the highest roles.
Putting people in roles directly. Direct user assignments are hard to review and survive team changes. Assign to groups, then review group membership. Watch nested groups and guest accounts. Forgetting data plane permissions is also common. A role that can manage a storage account does not always read blob data. Grant data actions only where needed, and check Key Vault roles separately. Custom roles with wildcard actions and NotActions can widen when Azure adds new actions, so test and pin the actions you need.
Treating service principals as service accounts with passwords. Prefer managed identities or federated credentials. Remove unused secrets and certificates, and give each workload its own identity. If you want an outside read before a customer security review or audit, the Cloud security review from Cloudverg is a fixed price $6,500 package that reviews identity and access across up to five subscriptions and gives you a ranked fix list. It is one option among others, and it does not replace your own access review process.
Frequently asked questions
What does least privilege mean in Azure?
It means each identity gets only the permissions needed for its task, at the smallest scope, for only as long as needed. In Azure you apply this to both Entra ID directory roles and Azure RBAC resource roles. Scope can be a management group, subscription, resource group or single resource.
Do Azure RBAC roles override Entra ID roles?
No. They control different things. Entra ID roles manage directory objects such as users, groups and app registrations. Azure RBAC roles manage Azure resources. An identity can have broad rights in one plane and narrow rights in the other, so review both.
Should I assign Azure roles to users or groups?
Assign to Entra security groups for people. That keeps role assignments stable when staff change and makes access reviews simpler. Use separate managed identities or service principals for workloads.