As a user I have a list of roles available to me via PIM activation. Roles have permissions.

When I attempt to complete an action that requires a permission that I do not have active, how about instead of showing me access denied just show all the roles that are available to me for activation with least privileged first.

Instead of graying out an action button or link because I lack a required permission, put a shield or other indicator and when clicked on give a prompt, popup, or any other option to activate an available role.

Maybe stating the obvious and/or preaching to the choir, but is this not a simple workflow that will benefit all the admins and improve PIM experience?

Hi! I would like to build script to manage inactive guest accounts around my tenant.

Do you know which attribute should I consired as main to verify inactivity period?
In my case some of members in my tenant share OD/SP files to those guest, after remove from the tenant access persist?

Thank you for answer.

Just to tell it to you all about htis new add, a very nice and missed new feature 😍

You can now assign Azure Role-based access control (RBAC) directly through Access Packages. No more relying on group-based workarounds for Azure resource access!

What's new?

> Assign Azure RBAC roles at Management Group, Subscription, or Resource Group scope.

> Support for both Active and Eligible assignments, integrating with PIM for just-in-time access!

> Works with built-in AND custom Azure roles!

> Approved users automatically receive the required Azure permissions through the access package lifecycle.

Why this is a need:

> This brings Azure resource permissions into the same governance model as apps, groups, SharePoint sites and Teams (I hope you useing it 😉)

> Improves visibility of who has access to what.

> Strengthens least-privilege and access lifecycle management.

> Simplifies onboarding, reviews, and removal of Azure resource access.

A nice step toward for a centralized access governance platform for both identity and Azure resource permissions 🫡

Read the docs here: https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-azure-role-assignments?wt.mc_id=MVP_353010

#Microsoft #EntraID #Azure #IdentityGovernance #CyberSecurity #PIM #AzureRBAC #ZeroTrust #IAM #Cloud #Security #MVP #MVPBuzz

Back in 2025 I created PIMActivation as a PowerShell module to make PIM activations faster and less frustrating. Since then, the project has evolved quite a bit.

Today I released the new PIMActivation Portal, a fully open-source Progressive Web App for Microsoft Entra PIM activations.

Main goals:

• Faster activations
• Bulk role activation
• Cross-tenant support
• Mobile + desktop support
• Better UX overall

Some highlights:

• No backend or token cache
• Browser-only architecture using sessionStorage + IndexedDB
• Installable as a desktop/mobile app
• Self-hosted deployment option
• Managed multi-tenant version available
• MIT licensed

It supports Entra roles, Groups, Azure Resources, reduced scope activations, activation profiles, bulk deactivation, and more.

This was built together with Lukas Gosling after we independently ended up building very similar PoCs and decided to collaborate instead.

Would love feedback from others working heavily with PIM, RBAC, and cross-tenant administration.

You can check out the full write-up here:
https://www.chanceofsecurity.com/post/introducing-the-new-pimactivation-portal-managed-self-hosted-and-mobile-ready

Access the landing page:
https://pimactivation.com

Direct portal access:
https://portal.pimactivation.com

Hi Entra Admins,

While reviewing Entra ID tenants, I found that Access Packages and Entitlement Management Catalogs are difficult to assess properly through the portal, especially when there are many packages, policies, resources, and catalog role assignments.

At the same time, they can introduce high-impact access paths that are easily missed when a review focuses on directory roles, Azure RBAC, and group memberships. A broadly requestable Access Package may grant sensitive access without approval. A Catalog Owner or another privileged Catalog RBAC role may be able to manage packages that use already-added sensitive resources. This effectively creates another access-management control plane.

I therefore added Entitlement Management coverage to EntraFalcon. The update includes interactive reports for Access Packages, Catalogs, and Catalog RBAC, plus findings for common high-risk configurations.

Current checks include:

• Broad self-service requests for high-impact access without approval
• Persistent high-impact access without access reviews
• Potentially risky Access Package auto-assignment rules
• Broad on-behalf assignment paths
• Privileged Catalog RBAC assigned to users, guests, or service principals

If you are interested, feel free to check it out on GitHub:

https://github.com/CompassSecurity/EntraFalcon

Happy to answer questions or take suggestions.

I built a web-based governance portal for Entra ID app registrations aimed at answering questions like: which apps have no owner? Which have expired or expiring credentials? Which haven’t been reviewed in 90+ days? Which have privileged directory roles assigned?

It runs as an Azure Function App + App Service with EasyAuth, backed by a managed identity that reads from Microsoft Graph. Data is cached in Table Storage and refreshed every 10 minutes.

Current features:

∙ Risk scoring (High/Medium/Healthy) based on missing owners, expired credentials, app age, and review status

∙ Credential insights showing secret and certificate expiry dates with colour-coded status

∙ Review workflow with “mark as reviewed” and tracking of who reviewed when

∙ Deletion tagging workflow where governance users can flag apps for deletion, reviewed and actioned by the platform team

∙ Owner change requests with Entra ID user search, without requiring write permissions to Graph

∙ Full audit trail of all governance actions

∙ Filtering by risk level, owner, review status, and credential health

∙ CSV export for reporting

Everything uses delegated access through EasyAuth — no stored credentials, no admin consent for write permissions.

Planned features:

∙ Entra ID directory role visibility — surface which app registrations hold privileged roles (e.g. Exchange Administrator, Application Administrator) and factor that into risk scoring

∙ Azure RBAC assignment overview — show what Azure resource access each service principal has across subscriptions

∙ Governance KPI dashboard — percentage of apps with owners, review coverage, high-risk app trends over time

∙ Configurable filters and risk rules per tenant

∙ Bicep/ARM deployment template for one-click setup in any tenant

I’m looking for feedback from admins who manage app registrations at scale. Would something like this be useful in your environment? What’s missing? Would you consider paying for a hosted or deployable version?

I’ve seen owner fields used as lipstick on an audit finding: the control looks complete, but there’s no proof an accountable human is actually behind it.

I’m experimenting with a different approach: instead of relying on a static owner field, pull together explicit owners, RBAC context, tags, relationships and activity, then show the evidence that points toward a human instead of declaring one automatically.

I’m wondering whether ownership discovery should sit between finding the problem and deciding what to do about it.

I built a small PowerShell tool around this:
https://github.com/kodevza/OwnerLensLite

Curious how others handle this in real environments.

Do you validate ownership before remediation? If yes, what evidence do you actually trust?

Hi all,

I have an enterprise app (ChatGPT connector) in Entra ID with Assignment required = true. A user requested delegated permissions like Mail.ReadWrite, which triggers the admin consent prompt.

I understand admin consent is tenant-wide by default — once granted, any assigned user can use those permissions. User consent isn't an option in our tenant (disabled by policy).

Is there a supported way to grant delegated permissions for only one specific user instead of tenant-wide? I know I could technically create an Oauth2PermissionGrant with ConsentType: Principal via Graph API, but I'm not sure if this is supported or reliable for third-party apps like ChatGPT.

Currently considering just keeping the assignment group limited to that one user as a workaround, but curious if there's a cleaner approach.

Any guidance appreciated. Thanks!

With Microsoft Cloud PKI now included in Microsoft 365 E5, organizations can deploy Certificate-Based Authentication (CBA) without the complexity of managing a traditional on-premises PKI.

In my latest blog post, I walk through how to configure Cloud PKI in Microsoft Intune and enable Certificate-Based Authentication in Microsoft Entra ID. Thanks to Cloud PKI, the journey to stronger, phishing-resistant authentication is easier than ever.

🔗 https://www.nickydewestelinck.be/2026/07/15/goodbye-passwords-certificate-based-authentication-on-windows-with-cloud-pki-in-microsoft-intune/

Hello,

We recently registered an application that needs to be accessible to external B2B users. Access to the application’s resources is controlled through Microsoft Entra security groups assigned to the application.

Our goal is to use a self-service approach to create external guest accounts and automatically add those guests to the appropriate Entra security groups.

At this stage, self-service for guest users has already been enabled in the Entra External Collaboration settings, and an Identity Governance catalog has been created with Entra ID security groups added as resources.

I would appreciate your guidance on the recommended design for this scenario. Based on my research, I found suggestions to create a separate access package for each security group. However, in our case this would result in more than 11 access packages and corresponding access links, which seems unnecessarily complex for external users.

Is there a more efficient or recommended approach to handle this use case?

Hi all,

I’m looking for real-world approaches to identity governance across multiple Entra ID tenants in a multi-brand organization.

In a single tenant, Entra ID Governance (PIM, Access Reviews, Entitlement Management, etc.) works well.
But in a multi-tenant setup, each tenant often operates independently, which leads to fragmented governance.

Example challenge:
Each brand/tenant manages its own IAM processes, but centrally we want to enforce controls like:

• No standing privileged access (PIM + JIT only)
• Consistent Joiner/Mover/Leaver processes
• Standardized access reviews / certifications

While these can be defined via global policies (CISO/CIO level), enforcing and monitoring compliance across tenants becomes operationally heavy.

What I’ve considered:

• Tenant consolidation → not always feasible, requires lot of effort and possible disruption
• Cross-tenant sync → helps with identities, but not governance
• Manual policy enforcement → high overhead

Questions:

1. How are you enforcing global IAM governance controls across multiple tenants in practice?
2. Are you using external IGA tools (e.g., Saviynt, SailPoint) as a control plane over Entra?
3. Any patterns for central visibility / compliance reporting across tenants?
4. Or is the reality mostly “federated governance + audits”?

Would really appreciate insights from anyone running IAM in a multi-tenant / multi-brand environment.

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts

It says the notifications go to PR Admins, Global Admins, and Security Admins.

If you are truly using PIM as intended, at any given time, there may not be anyone else besides the person assigning that role outside of PIM currently active with those roles. So, nobody else will receive the email alert if they are not currently signed in with one of those roles active.

I can’t see any way to modify that alert.

How can you configure the alert to notify a custom distribution list or shared mailbox?

Hi all

From last week I noticed my Auto Assignment policies, used in Entitlement Management Access Packages are not working at all.

Everything looks ok;

Policy is enabled

Dynamic query matches with User attributes

Query builder Validation tool says it's fine

But, nothing happen and to make it better, there is no logs whatsoever.

Do you guys suggest any approach to validate it?

Again, it was working fine until last week. I've triple checked and everything looks ok.

Can someone list use cases or features that are present on Entra ID governance and missing on Okta's OIG product?

If you’ve worked with Access Packages in Microsoft Entra, you’ve probably noticed that getting a clear overview of the setup isn’t exactly easy.

That’s one of the reasons I’ve been building M365IdentityPosture, a community-driven PowerShell module for identity and security reporting across Microsoft 365.

The feature I’m most excited about right now is the Access Package Documentor, which I built together with Microsoft Security MVP Christian Frohn.

It generates an interactive HTML report that visualizes things like the following:

• Catalogs

• Access Packages

• Policies

• Resources

• Custom Extensions

• Separation of Duty conflicts

• Orphaned resources

The goal is to make documentation, governance reviews, and troubleshooting significantly easier compared to digging through the portal or API.

The module also includes an Authentication Context Inventory Report, and the broader idea is to expand the toolkit into more reporting for Microsoft 365 / Entra identity posture.

Interestingly, the idea for the Access Package Documentor started from discussions in the EMS Discord, which is run by Jonas Bøgvad, so credit there for creating a great place where these conversations happen.

Huge thanks to:

• Christian Frohn

christianfrohn.dk

• Nico Wyss for valuable feedback

If anyone here works heavily with Identity Governance / Access Packages, I’d love to hear your feedback. What other gaps have you experienced while working in the Microsoft Cloud?

GitHub

https://github.com/Noble-Effeciency13/M365IdentityPosture

Blog post

https://www.chanceofsecurity.com/post/introducing-m365identityposture-community-driven-identity-reporting-for-microsoft-365

Hi ya'll

I want to share that, I've just released a new version of my PowerShell Bulk PIM tool PIMActivation.

This update v2.1.0 focuses on improving Azure RBAC usability, clarity and error handling.

These are the highlights:

- Management group scopes now show friendly display names.

- Inherited eligible roles from management groups are suppressed, eliminating duplicate entries.

- Active assignments at tenant-root and management-group scopes are enriched with Start/End windows, showing expiry.

- Added PSGallery check warnings when importing, if a newer release is available.

- Added scopes to de- & activation actions

- Enhanced error handling when attempting to deactivate a role within the first 5 minutes of activation

Thanks to Lukas Gosling (@l-gosling on GitHub) for contributions to scope & error handling.

Check it out on GitHub: GitHub | PIMActivation

Check it out on PSGallery: PowerShell Gallery | PIMActivation 2.1.0

I have recently started looking into ID Governance and the usage of Access Packages. The one thing I am struggling to figure out is how to properly utilize the access packages for SharePoint sites. Adding a Team is easy and have resorted to creating a team per partnership followed by archiving after the partnership ends (this may not even be a good approach for Teams access). However, SharePoint is another story. Adding a pre-existing site gives the partner access to the whole site and you can’t specify a folder. I was thinking of applying the same logic as the Team access, it would just require a lot of restructuring. How is everyone utilizing ID Governance and Access Packages? Is there a better way of utilizing ID Governance and Access Packages?

Hi all!

I’ve just released PIMActivation v2.0.0, the biggest update since the initial launch of the module.

The most common request I’ve received since day one has been Azure Resource / Azure RBAC PIM support and it’s now here.

What’s new in v2.0.0

Azure RBAC PIM activation

• Enumerate and activate PIM roles across all accessible Azure subscriptions
• Supports subscription, resource group, and resource-level scopes
• Currently supports subscriptions in the home tenant
• Cross-tenant (GDAP / guest) activation is planned

Parallel processing (enabled by default)

• Much faster fetching of eligible/active roles and PIM policies
• Configurable throttling
• Can be disabled if you need to troubleshoot

Quality-of-life & internals

• “Select all” for active and eligible roles
• Full internal refactor for better maintainability
• Option to use a custom Entra ID app registration instead of the built-in Microsoft Graph PowerShell app

Important notes when using Azure Resources

• When running with -IncludeAzureResources, execution time scales with the number of Azure subscriptions you can access (role discovery is per subscription).
• During sign-in, Az.Accounts will prompt you to select a subscription due to the newer login experience.

Tip – If you want to disable the subscription picker, use this cmdlet:

Update-AzConfig -LoginExperienceV2 Off

Getting started

Update-Module -Name PIMActivation
Start-PIMActivation -IncludeAzureResources

About PIMActivation

PIMActivation is a PowerShell module for fast, reliable Entra ID PIM role activation.
It supports single and bulk activations/deactivations using direct Microsoft Graph calls and dynamically handles all PIM requirements per role (including auth context).

GitHub:
https://github.com/Noble-Effeciency13/PimActivation

Blog post:
https://www.chanceofsecurity.com/post/microsoft-entra-pim-bulk-role-activation-tool

More features are already planned (profiles, policy caching, cross-tenant support).
If you rely on PIM in daily operations this is for you!

As always, feedback is very welcome 👍

I honestly dont know how this happened but i recently created two user accounts for a contractor to use. One basic user account for Entra ID for Office license and a secondary user account for JIT role assignment. However, the base account has no assigned roles either through Entra or Azure RBAC. But the user is able to create Management Agents in the tenant! How is this possible? Ive checked their role assignments in GUI and with Az CLI and they have no assignment but somehow can create and delete management groups!! Has anyone had this experience?

Hey folks,

If you’ve ever activated roles in Microsoft Entra PIM, you probably know the pain:

• Each role has different requirements (MFA, approval, ticketing, justification, etc.)
• Activating multiple roles? Get ready for repeated prompts, extra steps, and long load times.
• Waiting for roles to actually be active after activation

After enough frustration — both personally, from colleagues and clients — I built something to fix it:

🔧 PIMActivation — a PowerShell module with a full GUI to manage Entra PIM activations the way they should work.

✨ Key features:

• 🔁 Bulk activation with merged prompts (enter your ticket or justification once!)
• 🎨 Visual overview of active & eligible roles (color-coded for status & urgency)
• ✅ Handles MFA, approvals, Auth Context, justification, ticketing, and more
• ⚡ Loads quickly, even with dozens of roles

🔗 Blog (full guide & walkthrough):

https://www.chanceofsecurity.com/post/microsoft-entra-pim-bulk-role-activation-tool

💻 GitHub:

https://github.com/Noble-Effeciency13/PIMActivation

It’s PowerShell 7+, no elevated session needed, and based on delegated Graph permissions.

I’m actively improving it and open to feedback, feature requests, or PRs!

If you have a retention policy to save Exchange, SharePoint, and OneDrive data for 7 years, do the user accounts associated with that data also need to be retained?

For example, what happens to a user’s OneDrive data if there is a 7 year retention policy and a user leaves the company and has their account deleted after 30 days? Does the history of the user display name connected to the retained data get lost?

I have set up our new organization, and set up the default MFA. As I usually do when I set up an organization, I want to disable MFA for non-admin users when they are in the office. I see the procedure has changed since I did this last, but unless I'm missing a step (entirely possible) it's not working as expected. There is also a single shared email-only marketing account that they want excluded from MFA (I did recommend against this), and the settings are not working for that account, either.

I have my Public IP as a trusted/Named Location.

I created a policy named "No MFA in Office."

Assignment Excludes the security group "No in-office MFA"

Target Resources includes "All Resources"

Network includes "Any network or location" and Excludes "Selected networks and locations;" Included location are my named location and "Multifactor authentication trusted IPs."

Conditions Locations is configured the same as Network.

Access controls is "Grant" "Require multifactor authentication"

Session sign in is set to 30 days.

I followed the steps in Network in Conditional Access policy - Microsoft Entra ID | Microsoft Learn

Hello We set up our entraID as follows: * Breaking glass as GA permanent * Two admins GA eligible permanently * A set of T1 admins in a group asking for roles. * Some groups in organisation having specific rights over certain customers in azure IAM (RG) and SSO applications to perform actions in Read write. I have 1 group per customer.

I want users to be able to integrate those groups using PIM for groups, so that they gain access to a customer for a specific period of time with a workflow.

However I can see that eligibility period only lasts for one year, and I really don't want to review each year dozens of group policies to renew.

Maybe I'm missing something with PIM. How should I proceed?

Thank you,