Cloud Engineer · Zürich
RiskyRolesAnalyzer
One identity, yours. The script has no write path of its own, so reading and acting are two different sets of rights.
Microsoft.Graph.Authentication and Az.Accounts, installed on first run if missingTo run the audit
Your own account, on Graph and Azure in the same tenant.
RoleManagement.Read.Directory — Graph, delegatedDirectory.Read.All — Graph, delegatedGroup.Read.All — Graph, delegatedApplication.Read.All — Graph, delegatedReader — each subscription, or a management group above themTo act on a finding
Your own account, and only when you run the command yourself.
RoleManagement.ReadWrite.Directory — Graph, delegatedPrivileged Role Administrator — to remove an Entra assignmentUser Access Administrator or Owner — the scope of the assignment you remove-SkipAzure for an Entra-only tenant, -SkipPim where there is no P2.
It reports assignments. It does not know why they are there. Read the row, ask the owner, then decide.
| Do not use for | Why | Do this instead |
|---|---|---|
| Continuous monitoring | One run is one point in time | Defender for Cloud, Entra ID Protection, Sentinel |
| Attack path analysis | It lists and rates; it does not chain | BloodHound / AzureHound |
| Compliance baselines | No baseline to compare against | Maester, ScubaGear |
| Unattended cleanup | Every removal is meant to pass a person | Access reviews with auto-apply |
| Tenants you are not accountable for | Read is fine; write needs a mandate | Report only |