All writing / Entra ID & Least Privilege
Entra ID & Least Privilege
Almost every Azure environment grants more than it can justify, because Contributor was faster than reading the role definitions. This is about getting the permissions right and keeping them right.
- Articles
- 8
- Last updated
- Oct 2026
Start here
UNDERSTAND
The Privileged Role Exposures Defender Misses
A look at Tier Zero exposure paths that don’t show up in the obvious places — and a tool to find them. Update,…
FIXHardening Entra ID with Terraform
A practical implementation guide covering identity baseline, privileged access, conditional access, and monitoring – fully managed as infrastructure as code. Entra ID…
KEEP IT THAT WAYApp Lifecycle Analysis for Entra ID
Every large Entra tenant has the same problem: hundreds of app registrations, most of them forgotten. Here’s a tool to find them…
All articles
8 articles on this topic.
- The VMs that LAPS cannot reach still have passwordsWindows LAPS handles domain-joined machines. Entra login removes the local credential entirely. This is about the machines neither…12 min read
- There’s no built-in policy for Entra VM loginAzure ships a built-in policy to disable local accounts on your VMs. It ships none to enable the…10 min read
- Stop letting your AI guess Azure RBACazure-rbac-advisor — a prompt skill that researches least-privilege RBAC for your IaC and doesn’t make up permission strings.*…8 min read
- App Lifecycle Analysis for Entra IDEvery large Entra tenant has the same problem: hundreds of app registrations, most of them forgotten. Here’s a…8 min read
- The Privileged Role Exposures Defender MissesA look at Tier Zero exposure paths that don’t show up in the obvious places — and a tool…10 min read
- Least Privilege Studio: An Azure RBAC ToolIf you’ve ever set up a service principal in Azure and thought “I’ll just use Contributor for now”…5 min read
- Hardening Entra ID with TerraformA practical implementation guide covering identity baseline, privileged access, conditional access, and monitoring – fully managed as infrastructure…10 min read
- Entra ID Login with Azure Bastion (Public Preview)Managing credentials for virtual machines has always been a balancing act between security, usability, and operational overhead. With…3 min read