Review overprivileged accounts

A workflow for Identity Security Insights

Scope of this guide

Following this workflow on a regular basis helps your organization reduce the Azure attack surface, enforce least privilege across Entra ID and Azure RBAC, and maintain a clear audit record of privilege posture improvements over time.

Prerequisites

• Microsoft Azure instance

Workflow summary

Setup: Set up the Microsoft Azure connector

Why this matters

Before Identity Security Insights can discover your Azure identities, accounts, and entitlements, the Microsoft Azure connector must be configured. The connector uses a dedicated app registration (BT-SP-Connector) and a PowerShell onboarding script to grant read-only access to Entra ID, Azure RBAC, and activity logs. No write permissions are required. Setup is a one-time activity; the only ongoing maintenance is rotating the app registration client secret before it expires.

Prerequisites

Confirm the following before beginning connector setup:

• Auditing is enabled in Microsoft Purview / Azure (see Microsoft's Audit documentation).
• You have Azure Global Administrator privileges in the target tenant.
• The tenant has a minimum Microsoft Entra ID P1 licence.
• Azure PowerShell (Az module) is installed on your workstation, or you plan to use Azure CloudShell (Az is pre-installed in CloudShell).
• If you are enabling AI Agents (optional): Dataverse is enabled in your Power Platform environments, and you are a System Administrator for those environments.

Required roles and permissions

The following read-only permissions are granted automatically by the onboarding script. You do not need to assign them manually.

Create the Connector

1. Sign in to app.beyondtrust.io. From the navigation menu, select Insights > Connectors. The Connectors page displays.
2. Click Total configured, then click Create Connector and select Microsoft Azure from the list. The Create Microsoft Azure Connector panel displays.
3. Enter a human-readable name for the connector (for example, Contoso – Azure Production Tenant).
4. Select your cloud environment. Use the table below to identify the correct environment for your Azure portal URL.

FedRAMP compliance notice
Insights Commercial is not FedRAMP-compliant. Connecting it to Azure Government Community Cloud (GCC), GCC High, or Azure Government DoD environments may result in data residency issues and loss of compliance.

5. Click the on-screen link to sign in to the Microsoft Azure Portal as a Global Administrator.
6. In Entra ID, navigate to Properties and toggle Access management for Azure resources to Yes. You can toggle this back to No after running the onboarding script.
7. Select an installation method: Azure CloudShell (recommended) or PowerShell on Windows. Follow the appropriate sub-section below.

Install Using Azure CloudShell

8. Open Azure CloudShell and sign in by running:

   PowerShell

   Connect-AzAccount -UseDeviceAuthentication

9. Download the Azure onboarding script from Insights and upload it to Azure CloudShell.

10. Run the command provided by Insights for your selections.

11. In Insights, copy the tenant ID, directory name, client ID, and client secret from the script output into the appropriate fields.

12. Remove the script after setup by running:

    PowerShell

    Remove-Item -Path "./azuread_powerplatform_onboarding.ps1"

Install Using PowerShell on Windows

13. Ensure the Azure PowerShell Az module is installed. See the Azure PowerShell documentation for installation instructions.

14. Open PowerShell as a standard user and log in to Azure:

    PowerShell

    Connect-AzAccount

15. Confirm you are connected to the correct tenant. List all tenants you have access to:

    PowerShell

    Get-AzTenant

16. Set the correct tenant context, where TenantID is the ID of your target directory:

    PowerShell

    Set-AzContext -Tenant "TenantID"

17. Verify the selected context:

    PowerShell

    Get-AzContext

18. If scripts must be digitally signed in your environment, run the following before executing the onboarding script:

    PowerShell

    Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

19. Download the onboarding script from Insights and run it using the command provided.

20. In Insights, copy the tenant ID, directory name, client ID, and client secret from the script output into the appropriate fields.

Grant Admin Consent for the App Registration

21. In the Microsoft Azure Portal, navigate to Azure Services > Microsoft Entra ID.
22. Select App Registrations in the left menu.
23. Select the BT-SP-Connector application.
24. In the API permissions section, click Grant admin consent and confirm your selection.

Configure Azure Event Hub (Required for Tenants with 100,000+ Users)

ℹ️

Note

If your tenant has fewer than 100,000 users and you are not subscribed to Azure Event Hub, select No from the Use Azure Event Hub dropdown in Insights and skip this section.

25. In Insights, copy the Insights-generated Azure Event Hub script.
26. Paste and run the script in your Azure shell environment.
27. Once complete, save the Fully Qualified Hub Namespace, Blob Container URL, and Hub Name in a secure location.
28. Follow Microsoft's procedure to stream Entra ID logs to an event hub (see Microsoft documentation: howto-stream-logs-to-event-hub).
29. Within Azure Diagnostics settings, enable the following log categories to stream:
    • SignInLogs
    • NonInteractiveUserSignInLogs
    • ServicePrincipalSignInLogs
    • ManagedIdentitySignInLogs
30. In Azure Destination details, select Stream to an event hub and select the Fully Qualified Hub Namespace and Hub Name saved above.
31. In Insights, enter the Fully Qualified Hub Namespace, Blob Container URL, and Hub Name in the appropriate fields, then click Create Connector.

ℹ️

After creating the connector, verify it is turned on. Navigate to the connector's Overview page in Insights and confirm the status is enabled.

Network access for Microsoft Foundry (optional, AI agents only)

This section applies only if you are enabling AI Agents in Identity Security Insights. By default, Foundry environments are set to All networks and no changes are required. If your Foundry environment uses restricted network access, add the following BeyondTrust IP addresses to the firewall allowlist.

Rotate the Client Secret (ongoing maintenance)

App registration client secrets expire according to the policy set when they were created. When a secret is approaching its expiry date, follow these steps to rotate it without disrupting the connector.

In Microsoft Azure

32. Search for Microsoft Entra ID in the Azure Portal and select it.
33. Under Manage in the left menu, select App registrations.
34. Locate and select BT-SP-Connector. Note the Application (client) ID for reference.
35. Under Manage, select Certificates & Secrets.
36. Click + New client secret. Provide a description and set an expiry date according to your organization's policy, then click Add.
37. Copy the Secret Value immediately and store it in a secure location. The value is only shown once.

In Identity Security Insights

38. Navigate to the navigation menu > Insights > Connectors. The Connectors page displays.
39. Locate and select the Microsoft Azure connector in the Configured Connectors list.
40. Open the Settings tab. Confirm the Client ID matches the one noted in the Azure steps.
41. Paste the new Secret Value into the client secret field and click Save Changes.

Tip
Set a calendar reminder or Azure Policy alert approximately 30 days before the client secret expiry date to ensure you have time to rotate it before the connector loses access.

Step 1: Review the Home Dashboard

After the Azure connector has been configured and data has been ingested, the Identity Security Insights Home page provides a centralised view of privilege risk across your Entra ID tenant. From here, you can see the total number of identities with Highest and High True Privilege, spot escalation chains originating from Azure RBAC roles and Entra ID groups, and navigate directly into the areas that need attention.

Why this matters

The Home Dashboard gives you an immediate snapshot of Azure privilege posture across your entire Entra ID and Azure RBAC environment. Before drilling into individual identities or accounts, the dashboard orients you to the most pressing areas of risk so you can focus the review where it matters most. Security managers will find the summary tiles particularly useful for communicating Azure privilege risk to stakeholders.

Steps

42. Sign in to app.beyondtrust.io. The BeyondTrust Home page displays.
43. From the top left, click the navigation menu icon and select Insights. The Insights Home page (dashboard) displays.
44. Review the Identities by True Privilege summary. This tile shows the count and percentage of identities with Highest and High True Privilege. In an Azure estate, these typically include Global Administrators, Privileged Role Administrators, and users with broad Owner or Contributor assignments across subscriptions.
45. Note the four identity count tiles: Risky privileged identities, Identities with dormant accounts, Identities with escalations, and Identities with multiple providers. Each tile is a quick count of identities that warrant closer review.
46. Click View Escalation Paths (or navigate to Entitlements) to see a visualisation of privilege escalation chains. Apply the Provider filter and select your Azure connector to focus on Azure-specific escalation paths.
47. Review the Top 5 identities with the most accounts. In a hybrid environment, these are often users with both an on-premises AD account (synced to Entra ID) and one or more cloud-native accounts — a common source of unintended accumulated privilege.

Reference: Identity Count Tiles

Step 2: Review overprivileged identities

Why this matters

In Azure, identities accumulate privilege through Entra ID role assignments, group-based access, and Azure RBAC inheritance. Reviewing identities by True Privilege surfaces the users who could reach Global Administrator or subscription Owner — whether through direct assignment or through escalation chains invisible in the Azure Portal. Shadow administrators (users whose group or role memberships grant admin-level access without an explicit admin role assignment) are particularly common in mature Azure tenants and rarely visible without a tool like Identity Security Insights.

Overview

The Identities page ranks every user by their True Privilege level across all connected providers. Filtered to your Azure connector, it shows you who in your Entra ID tenant has the highest potential blast radius if their account were compromised — including users who are overprivileged through Entra ID group membership, Azure RBAC role inheritance, or misconfigured Conditional Access exclusions.

Steps

48. Navigate to Insights > Identities. The Identities page displays all identities ranked by True Privilege.
49. Confirm the grid is sorted by True Privilege descending (Highest first). This is the default sort order.
50. Review the Identities by True Privilege summary panel. Note the count of Highest and High privilege identities from your Azure connector — these are your priority candidates for the review.
51. Apply a True Privilege filter: select Highest to see identities that could reach Global Administrator-level access in your Entra ID tenant.
52. Set Has Detections = Yes to surface identities that combine high Azure privilege with active security findings — the highest-urgency cases.
53. Apply the Dormant filter (e.g., 60 days) to find highly privileged Entra ID identities that have not logged in recently. These are common targets for attackers, especially in organisations that have had staff changes.
54. Review the Accounts column. Identities with a high account count in an Azure estate often have both an on-premises synced account and cloud-native accounts — check whether all linked accounts are still required.
55. Export the filtered list as a .csv using the Download button for use in a formal privilege review or security report.

Reference: Identities Page Controls (Azure Context)

ℹ️

An identity's True Privilege in Azure can be significantly higher than what is visible in the Entra ID Portal. A user with only the 'User' role may still have Highest True Privilege if they are a member of an Entra ID group assigned the Global Administrator role, or if they own a group that grants admin access. True Privilege captures these indirect relationships; the portal does not.

Step 3: Investigate Individual Identities

Why this matters

Once high-priority Azure identities are identified, the side panel gives you everything needed to understand the risk and decide on remediation. The True Privilege graph is especially powerful in Azure environments: it makes visible the Entra ID group and Azure RBAC chains that allow a seemingly low-privileged user to reach Global Administrator or subscription Owner — relationships that are impossible to see in a single Azure Portal blade.

Overview

Clicking any identity opens a side panel with six tabs: Overview, Accounts, Detections, Recommendations, Entitlements, and Paths. For an Azure estate, the key tabs are Accounts (to see all Entra ID and Azure accounts linked to this person), Entitlements (to see the specific Azure RBAC roles and Entra ID roles that create elevated access), and Paths (to visualizze escalation chains in the True Privilege graph).

Steps

56. On the Identities page, click an identity name to open the side panel.
57. Review the Overview tab. Note the True Privilege level and whether the identity is flagged as a shadow administrator. Click View True Privilege Graph.
58. Open the Accounts tab. For each linked account, note the Provider (this will show Azure / Entra ID). Identify accounts from Azure tenants or subscriptions the identity no longer needs access to.
59. Open the Detections tab. Review all Azure-specific detections for this identity — look in particular for detections related to suspicious service principal changes, logins from anonymized IPs, Conditional Access bypasses, or MFA fatigue.
60. Open the Recommendations tab. In Azure estates, common recommendations include enabling Conditional Access policies for the Azure AD Connector account, enrolling high-privilege accounts in Password Safe, and removing Global Administrator from accounts that no longer require it.
61. Open the Entitlements tab. Review the Azure RBAC roles (Owner, Contributor, User Access Administrator) and Entra ID directory roles (Global Administrator, Privileged Role Administrator) held by this identity's linked accounts.
62. Open the Paths tab or click the True Privilege graph icon to launch the interactive node graph. Trace the escalation chains from the identity through its accounts and entitlements.
63. In the graph, look for choke points: Entra ID groups or Azure RBAC roles connected to many identities via orange escalation lines. These are the highest-value remediation targets — fixing one group or role assignment can reduce privilege for many users at once.
64. Click any node to open a detail panel. For an Entra ID group node, this shows membership count and the entitlements granted. For an Azure RBAC role node, it shows the scope (subscription, resource group, or resource) and the accounts assigned.

Reference: Identity Side Panel Tabs (Azure Context)

Step 4: Review Overprivileged Accounts

Why this matters

In Azure, not every account belongs to an active, managed identity. Service accounts, legacy local accounts, and break-glass emergency accounts often exist outside the visibility of normal identity governance processes. The Accounts page surfaces all accounts discovered by the Azure connector — including those not linked to any managed identity — so you can assess whether high-privilege accounts are justified, still in use, and properly controlled.

Overview

The Accounts page provides a view of every account discovered by the Azure connector, ranked by True Privilege. It shows account type, activation state, dormancy, key entitlements, active detections, and outstanding recommendations. Use this page to find Azure accounts that are highly privileged but dormant, unmanaged, or outside your federated identity setup.

Steps

65. Navigate to Insights > Accounts. The Accounts page displays all accounts ranked by True Privilege.
66. Apply the Provider filter: select your Azure connector to focus the view on Entra ID and Azure accounts only.
67. Confirm the sort order: True Privilege descending (Highest first). Review all Highest and High accounts before moving to Moderate.
68. Filter Account Type to review specific categories in sequence. Start with service accounts and managed identities — these are common sources of excessive Azure privilege that are rarely reviewed in routine access reviews.
69. Apply the Dormant filter (60 days). High-privilege Azure accounts that have not been used in 60 or more days should be reviewed for disablement particularly accounts outside your Entra ID-managed lifecycle.
70. Review the Detections column. Accounts with multiple detections especially on accounts with Highest True Privilege are the highest-urgency cases. Click the count to see the specific detections.
71. Review the Key Entitlements column. Azure accounts with a high count of key entitlements may have accumulated access across multiple subscriptions or resource groups over time.
72. Click an account name to open the side panel. Review the Detections, Entitlements, and Recommendations tabs. For accounts linked to an identity, click the True Privilege graph icon to view the full privilege chain.
73. Document any accounts that should be disabled, have their Azure RBAC roles downscoped, or be onboarded to BeyondTrust Password Safe for managed credential rotation.

Reference: Accounts Page Filters for Azure Review

Step 5: Review Entitlements

The Entitlements page lists every entitlement discovered by the Azure connector, ranked by privilege level. For an Azure estate, this includes Entra ID directory roles (such as Global Administrator, Privileged Role Administrator, Security Administrator), Azure RBAC roles (Owner, Contributor, User Access Administrator), API permissions, and group memberships that confer elevated access. The Paths to Privilege graph shows the escalation chains that connect these entitlements to identities.

Why this matters

In Azure, overprivilege is most often conferred through Entra ID directory roles and Azure RBAC role assignments rather than directly to individual accounts. A single overprivileged Entra ID group or RBAC role can be the root cause behind dozens of overprivileged identities. The Entitlements page lets you find these root causes directly, so you can fix the source, not just the symptoms, and reduce privilege for many users at once.

Steps

74. Navigate to Insights > Entitlements. Apply the Provider filter and select your Azure connector.
75. The page defaults to Privilege descending. Review all Highest-privilege entitlements first. In Azure, these typically include Global Administrator, Privileged Role Administrator, and subscription-level Owner roles.
76. For each Highest-privilege entitlement, review the Accounts count. An Entra ID directory role or Azure RBAC role with a high account count represents a large blast radius. Investigate any entitlement where the number of accounts seems higher than business requirements justify.
77. Apply the Type filter. Select Role to see Azure RBAC roles and Entra ID directory roles. Select Group member to see Entra ID security groups that grant elevated access. Select Permission (API permission) to see app registrations or service principals with broad Microsoft Graph permissions.
78. Click any entitlement name to open the detail panel. Review the list of accounts assigned this entitlement, their source provider, and whether any are dormant or external.
79. For Highest and High-privilege entitlements, click the True Privilege graph icon to open the Paths to Privilege graph. Inspect the chains that connect accounts to this entitlement. Identify choke points — groups or roles that grant access to many accounts simultaneously.
80. Apply the Scope filter for Azure RBAC roles to narrow results to a specific subscription, resource group, or resource. This is essential in large Azure environments with many subscriptions.
81. Use the Export settings to save a filtered PDF view for inclusion in an access review report.

Reference: Azure Entitlement Privilege Levels

Reference: Key Azure Entitlement Types in ISI

ℹ️

If your organization uses Azure Privileged Identity Management (PIM), entitlements in Identity Security Insights may reflect both active and eligible role assignments, depending on connector configuration. Review eligible assignments as carefully as active ones — eligible Global Administrator assignments can be activated without additional approvals in some PIM configurations.

Step 6: Review Detections

The Detections page summarizes active risk findings across all connected providers. Filtered to your Azure connector, it shows Entra ID and Azure-specific findings including suspicious login activity, service principal misuse, password attacks, dormant account activity, and anomalous Azure infrastructure changes. Detections are ranked by Importance (Critical, High, Medium, Low) and listed in order of discovery date by default.

Why this matters

Azure-specific detections in Identity Security Insights go beyond what Entra ID Identity Protection surfaces on its own. They cross-correlate sign-in risk signals, configuration changes, anomalous account behavior, and BeyondTrust product activity to provide a broader picture of active risk. A detection on an account with Highest True Privilege is your most urgent remediation priority — a compromise of that account could grant an attacker Global Administrator access to your entire Entra ID tenant.

Steps

82. Navigate to Insights > Detections. Apply the Provider filter and select your Azure connector to focus on Azure-specific findings.
83. Review detections sorted by Importance descending. Triage Critical and High detections before addressing lower-severity findings.
84. Click any detection name to open the Overview panel. Read the full description: the trigger condition, the concern it raises, and the recommended remediation action.
85. Cross-reference detections with the Identities and Accounts pages. Click through from a detection to the affected account or identity to understand their full privilege context before deciding on a response.
86. For anomaly-based detections (AI-backed): read the detail carefully. These may describe unusual Azure infrastructure changes or unexpected service principal behavior that does not match a known attack signature — determine whether the activity is legitimate in context.
87. Download the detection list to a .csv file for use in an incident response workflow, to raise tickets in ServiceNow or Jira, or to include in a security review report.

Reference: Key Azure-Specific Detections

ℹ️

The Azure connector ingests activity logs from Entra ID sign-in events, audit logs, and (if configured) from Azure Event Hub. Richer anomaly-based detection coverage — particularly for service principal activity and infrastructure changes — is available when Azure Event Hub is configured with the full set of log categories (SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs).

Step 7: Review recommendations and remediate

Overview

The Recommendations page groups security posture guidance by recommendation type, ranked by importance and the number of impacted accounts. For an Azure estate, the most common high-priority recommendations relate to the Azure AD Connector account, missing Conditional Access policies, unrotated passwords on privileged accounts, dormant privileged users, and accounts that should be managed by Password Safe. Authorised users can update the status of each recommendation and add comments to track progress.

Why this matters

Azure Recommendations in Identity Security Insights surface the specific Entra ID and Azure RBAC misconfigurations that create the privilege risk you have identified in the previous stages. Acting on these recommendations directly reduces your attack surface. Tracking remediation status in ISI creates an auditable record of Azure privilege posture improvements — useful for internal security governance, compliance reporting, and demonstrating progress to stakeholders.

Steps

88. Navigate to Insights > Recommendations. Apply the Provider filter and select your Azure connector.
89. The page defaults to Grouped view, sorted by Importance descending. Review High-importance recommendations first.
90. Review the Accounts column. Azure recommendations affecting many accounts — such as 'MFA Not Enabled' or 'Privileged user with an old, unrotated password' — may be more efficiently addressed through an Entra ID policy change than account-by-account remediation.
91. Click a recommendation name to open the Recommendation Details page. Review the affected accounts, their True Privilege levels, and providers.
92. Click Quick View on any row for a high-level summary before deciding whether to action it.
93. Click an account name to open the Instance Details page — this shows the full recommendation description, importance level, the underlying Azure-specific concern, and specific resolution steps.
94. Select one or more accounts and click Update Status. Choose the appropriate status: New, In Progress, Resolved, False Positive, or Ignored.
95. Add a comment to document the action taken — for example, a ServiceNow or Jira ticket reference, the name of the engineer who performed the remediation, or the reason for marking an item as a False Positive.
96. Click Update Status to save. The status and comment history are preserved for audit purposes.
97. After completing a remediation round, export the Recommendations grid as a .csv for reporting or integration with your ticketing system.

Reference: Key Azure-Specific recommendations

Reference: Recommendation Status Values

✅

Tip

If your organization uses Microsoft Sentinel, Identity Security Insights supports a Microsoft Sentinel webhook integration that can forward Detections to Sentinel as security alerts. This allows your SOC team to triage ISI findings within their existing investigation workflow. See the Integrations section of the Insights documentation for setup steps.

Summary

Overprivilege in an Azure estate is a continuous problem, not a one-time event. Entra ID group memberships accumulate, Azure RBAC role assignments persist after project completion, and new accounts are created without always following least-privilege conventions. Consider establishing a regular cadence for privilege reviews using this workflow.