Automating Azure
Identity Governance.

As cloud environments scale, one of the biggest vulnerabilities isn't network misconfiguration, but over-privileged identities. Permanent role assignments (like "Contributor" or "Owner") inherently break the principles of Least Privilege. If an attacker compromises an active admin account, they immediately gain full control.

To address this, we need to shift from static access provisioning to dynamic governance using Azure AD Privileged Identity Management (PIM), Access Reviews, and proactive monitoring. By codifying these governance rules via Infrastructure as Code (Bicep), we ensure that our security posture remains immutable and compliant.

Here is a breakdown of the architecture developed in the Identity Governance Automation project.

1. The Architecture

The goal is to automate the access lifecycle. Instead of users retaining privileges indefinitely, they are assigned "Eligible" rights. They must justify their need when required, and the access automatically expires after a predefined period.

Core Components

• Privileged Identity Management (PIM): Enforces Just-In-Time (JIT) access securely, reducing the attack surface by minimizing exposure time of highly privileged roles.
• Access Reviews: Regularly audits who has access and whether that access is still warranted via automated attestations.
• Activity Log Alerts: Monitors for any role assignments that bypass our PIM workflow and immediately alerts SecOps.

2. Implementing Zero Standing Privileges

By defining PIM eligibility directly in our Bicep modules, we can securely assign roles to object IDs dynamically.

// Bicep: Creating PIM Eligibility for Contributor
resource roleEligibilityScheduleRequest 'Microsoft.Authorization/roleEligibilityScheduleRequests@2022-04-01-preview' = {
  name: guid(uniqueString(principalId, roleDefinitionId))
  properties: {
    principalId: principalId
    roleDefinitionId: roleDefinitionId
    requestType: 'AdminAssign'
    scheduleInfo: {
      startDateTime: utcNow()
      expiration: {
        type: 'AfterDuration'
        duration: 'P365D' // Eligible for 1 year
      }
    }
  }
}

This module sets a user as an eligible Contributor for 365 days. The user still has to go through Entra ID PIM to activate the role and specify a justification or ticketing system reference.

3. Automating Attestation (Access Reviews)

Over time, team compositions change. Access creep occurs when people retain permissions they no longer need. Using Azure Access Reviews, we automate the governance loop by requesting the assignees themselves (or their managers) to validate their current access need every quarter.

If a user fails to respond, we can configure the system to automatically revoke access, enforcing the principle of Least Privilege programmatically.

4. Detecting Privilege Escalations

What happens if another malicious administrator manually assigns a permanent role, bypassing PIM entirely? We need observability built directly into our infrastructure to alert SecOps.

We achieve this by deploying an Activity Log Alert targeting the Microsoft.Authorization/roleAssignments/write operation.

// Bicep: Privilege Escalation Alerting
resource alertRule 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: 'Alert-RoleAssignment-Created'
  location: 'Global'
  properties: {
    scopes: [ subscription().id ]
    condition: {
      allOf: [
        {
          field: 'category'
          equals: 'Administrative'
        }
        {
          field: 'operationName'
          equals: 'Microsoft.Authorization/roleAssignments/write'
        }
      ]
    }
    actions: {
      actionGroups: [ { actionGroupId: actionGroup.id } ]
    }
  }
}

This rule ensures any new role assignment instantly triggers an alert (e.g., via Email, SMS, or Logic App playbook integration) so that unauthorized privilege escalation is caught in real-time.

Conclusion

Governance is not a one-time checklist; it is an ongoing process. By automating your entitlement lifecycle and access reviews, you lower your operational overhead while substantially improving your security posture against internal and external threats.

<< Return to Project Overview