Identity security & governance for Microsoft Azure
Azure access lives in two layers — Entra ID directory roles and resource-level RBAC — and IGA tools that stop at the directory miss how permissions flow down to subscriptions and resources. Oleria connects both layers into a single continuous identity security graph.
.png){kind=small}
Key Takeaways
- Azure access lives in two separate layers: Microsoft Entra ID directory roles and Azure resource-level RBAC permissions, and IGA tools that stop at the directory miss how control plane permissions flow down to subscriptions, resource groups, and individual resources.
- Managed identities and service principals assigned Owner or Contributor roles at the subscription level create standing cloud infrastructure access that no directory-level governance tool inventories or certifies against current workload requirements.
- Oleria connects both Entra ID directory roles and Azure resource permissions into a single continuous identity security graph, mapping every human identity, managed identity, and service principal alongside CloudTrail-equivalent activity to show which permissions are exercised versus dormant.
- Continuous Azure access certification through Oleria identifies standing Owner and Contributor assignments that should be replaced with just-in-time access, service principals with over-provisioned resource roles, and guest accounts that retain resource access after their projects end.
This summary was created with AI and reviewed by an editor.
Ask AI to write a summary
Featured event: A CISO’s take
Join Jim Alkove and Ramy Houssaini to learn how forward-thinking security teams are addressing Enterprise AI Copilot risks.
See who really controls your cloud, from Entra ID to every resource
Oleria's Azure integration gives security teams one view of who can access Microsoft Azure, how they got that access, and whether they use it. It brings Azure identity governance to directory roles, resource permissions and the non-human identities that run your workloads.
Azure access lives in two places: Microsoft Entra ID (formerly Azure AD) and Azure resource permissions. Oleria connects both in a continuous identity security graph, so you can find standing privilege and remove it.
Why is Azure access so hard to govern?
Legacy identity governance and administration (IGA) tools stop at the directory. They miss how permissions flow down to cloud resources.
- Two kinds of admin. Powerful Entra ID directory roles don't line up with Azure role-based access control (RBAC), so admin rights can grow unnoticed.
- Machine identities pile up. Pipelines, managed identities and third-party apps often keep Owner or Contributor rights with no key rotation.
- Access flows downhill. Rights granted at a management group or subscription cascade to every resource group and resource below.
- Guests overstay. Partner and guest accounts collect group memberships and resource rights that nobody re-certifies.
What Oleria shows you in Azure
Key security and compliance use cases
- Govern service principal blast radius: Identify over-privileged app registrations and service principals holding broad subscription rights to enforce strict least-privilege policies.
- Audit high-privilege directory roles: Track Global Admin and custom directory role assignments continuously to prevent unauthorized administrative escalation.
- Detect & remediate inherited RBAC sprawl: Unroll permission assignments across Management Groups and Subscriptions to surface and revoke standing over-privilege.
- Enforce continuous least-privilege: Cross-reference assigned Azure RBAC roles with real-time audit activity to flag and right-size permissions unused for 30, 60, or 90 days.
- Automated and targeted remediation: Directly assign or remove Azure roles, disable managed identities, and revoke public blob container access to eliminate exposure immediately.
- Continuous risk checks and posture monitoring: Automatically detect over-privileged direct subscription roles, Azure Policy non-compliance, storage TLS/HTTPS issues, overly broad Key Vault access policies, expiring service principal credentials, and dormant accounts holding active role assignments.
- Ingest cloud findings and governance delegations: Integrate Microsoft Defender for Cloud findings and gain visibility into Azure Lighthouse cross-tenant delegations and deny assignments.
Technical setup overview
Oleria connects in minutes using standard Microsoft Azure App Registration and service principal authentication:
- Authentication: App Registration created in your primary Microsoft Entra ID tenant with a client secret or certificate credential.
- Permission scoping: Assigned required read-only Directory and Azure RBAC permissions (such as Directory.Read.All and Subscription Reader roles) to inspect identities and resources.
- Data sync: Executes an initial full snapshot of Entra ID directory objects, subscriptions, RBAC assignments, and service principals, followed by continuous incremental syncs.
Explore the complete Oleria Azure integration guide.
Frequently asked questions
Does Oleria support multi-subscription scanning across Azure Management Groups?
Yes. Assigning the Oleria service principal read access at the Management Group level enables Oleria to automatically discover and govern Azure RBAC permissions across all child Subscriptions and Resource Groups.
How does Oleria handle non-human identities in Azure?
Oleria discovers all Entra ID service principals and App Registrations, tracks secret and certificate expiration dates, and maps their API and RBAC permission scopes.
Can Oleria differentiate between Entra ID directory roles and Azure RBAC roles?
Yes. Oleria evaluates both directory-level roles (like Global Administrator) and Azure resource-level RBAC assignments (like Contributor on a Subscription) to calculate complete effective access.
