Review overprivileged accounts

A workflow for Identity Security Insights

In an Azure estate, privilege accumulates quietly. Entra ID group memberships build up, Azure role-based access control (RBAC) assignments outlive the projects that needed them, and a user with no admin role can still reach Global Administrator through a group they joined years ago. If an attacker compromises one of those accounts, the blast radius covers your whole tenant. This workflow shows you how to find and reduce that privilege using Insights.

Scope of this guide

This guide covers a full privilege review of a Microsoft Azure and Entra ID environment in Insights, from setting up the Microsoft Azure connector through to tracking remediation. It does not cover reviews of other connected providers, and it does not cover making changes inside the Azure Portal beyond the connector setup itself. Run this workflow on a regular cadence to reduce your Azure attack surface and build an audit record of your privilege posture over time.

Prerequisites

Confirm all of the following before you start:

• You have a Microsoft Azure tenant with a minimum Microsoft Entra ID P1 license.
• You have Global Administrator privileges in the target Azure tenant.
• You have an Insights account with permission to create connectors and update recommendation statuses.
• Auditing is turned on in Microsoft Purview and Azure. See Microsoft's audit documentation.
• Azure PowerShell (the Az module) is installed on your workstation, or you plan to use Azure CloudShell, where the Az module is pre-installed.
• If you plan to turn on AI Agents: Dataverse is turned on in your Power Platform environments, and you are a System Administrator for those environments.
• If your tenant has 100,000 or more users: you have an Azure Event Hub subscription.

Steps

Step 1: Set up the Microsoft Azure connector

Insights cannot discover your Azure identities, accounts, or entitlements until the Microsoft Azure connector is set up. The connector uses a dedicated app registration named BT-SP-Connector and a PowerShell onboarding script to grant read-only access to Entra ID, Azure RBAC, and activity logs. No write permissions are needed. This is a one-time task. The only ongoing maintenance is rotating the client secret before it expires.

Permissions granted by the onboarding script

The onboarding script grants the following read-only permissions. You do not need to assign them by hand.

Create the connector

1. Sign in to app.beyondtrust.io. From the navigation menu, select Insights > Connectors. The Connectors page displays.

2. Select Total configured, select Create Connector, and then select Microsoft Azure. The Create Microsoft Azure Connector panel displays.

3. Enter a name that people will recognize, for example Contoso - Azure Production Tenant.

4. Select your cloud environment. Use the following table to match your Azure Portal URL to the right environment.

   Azure Portal URL	Cloud environment
   https://portal.azure.com	Commercial / GCC
   https://portal.azure.us	GCC High / DoD

   FedRAMP compliance notice

   Insights Commercial is not FedRAMP-compliant. Connecting it to Azure Government Community Cloud (GCC), GCC High, or Azure Government DoD environments may cause data residency issues and loss of compliance.

5. Select the on-screen link to sign in to the Microsoft Azure Portal as a Global Administrator.

6. In Entra ID, go to Properties and set Access management for Azure resources to Yes. You can set this back to No after you run the onboarding script.

7. Choose an installation method: Azure CloudShell (recommended) or PowerShell on Windows. Follow the matching procedure below.

Install using Azure CloudShell

1. Open Azure CloudShell and sign in:

   PowerShell

   Connect-AzAccount -UseDeviceAuthentication

2. Download the Azure onboarding script from Insights and upload it to Azure CloudShell.

3. Run the command that Insights provides for your selections.

4. In Insights, copy the tenant ID, directory name, client ID, and client secret from the script output into the matching fields.

5. Remove the script:

   PowerShell

   Remove-Item -Path "./azuread_powerplatform_onboarding.ps1"

Install using PowerShell on Windows

1. Confirm the Azure PowerShell Az module is installed. See the Azure PowerShell documentation for installation instructions.

2. Open PowerShell as a standard user and sign in to Azure:

   PowerShell

   Connect-AzAccount

3. List the tenants you have access to:

   PowerShell

   Get-AzTenant

4. Set the tenant context, where TenantID is the ID of your target directory:

   PowerShell

   Set-AzContext -Tenant "TenantID"

5. Verify the selected context:

   PowerShell

   Get-AzContext

6. If your environment requires scripts to be digitally signed, run the following before you run the onboarding script:

   PowerShell

   Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

7. Download the onboarding script from Insights and run it using the command Insights provides.

8. In Insights, copy the tenant ID, directory name, client ID, and client secret from the script output into the matching fields.

Grant admin consent for the app registration

1. In the Microsoft Azure Portal, go to Azure Services > Microsoft Entra ID.
2. In the left menu, select App registrations.
3. Select the BT-SP-Connector application.
4. In API permissions, select Grant admin consent and confirm.

Set up Azure Event Hub

Complete this procedure only if your tenant has 100,000 or more users. If your tenant is smaller and you do not subscribe to Azure Event Hub, select No from the Use Azure Event Hub list in Insights and skip to the next procedure.

1. In Insights, copy the Azure Event Hub script that Insights generates.
2. Paste and run the script in your Azure shell.
3. When the script finishes, save the Fully Qualified Hub Namespace, Blob Container URL, and Hub Name somewhere secure.
4. Follow Microsoft's procedure to stream Entra ID logs to an event hub.
5. In Azure diagnostic settings, turn on the following log categories:
   • SignInLogs
   • NonInteractiveUserSignInLogs
   • ServicePrincipalSignInLogs
   • ManagedIdentitySignInLogs
6. In Azure destination details, select Stream to an event hub, then select the Fully Qualified Hub Namespace and Hub Name you saved.
7. In Insights, enter the Fully Qualified Hub Namespace, Blob Container URL, and Hub Name in the matching fields, then select Create Connector.

✅

After you create the connector, confirm it is turned on. Go to the connector's Overview page in Insights and check that the status is enabled.

Allow network access for Microsoft Foundry

Complete this procedure only if you are turning on AI Agents in Insights. By default, Foundry environments are set to All networks and no change is needed. If your Foundry environment restricts network access, add the following BeyondTrust IP addresses to the firewall allowlist.

Rotate the client secret

App registration client secrets expire based on the policy set when they were created. When a secret is close to expiry, rotate it using these steps so the connector keeps working.

In the Microsoft Azure Portal:

1. Search for Microsoft Entra ID and select it.
2. Under Manage, select App registrations.
3. Find and select BT-SP-Connector. Note the Application (client) ID.
4. Under Manage, select Certificates & secrets.
5. Select + New client secret. Enter a description, set an expiry date that matches your organization's policy, and select Add.
6. Copy the Secret Value right away and store it somewhere secure. Azure shows this value only once.

In Insights:

7. From the navigation menu, select Insights > Connectors. The Connectors page displays.
8. Find and select the Microsoft Azure connector in the Configured Connectors list.
9. Open the Settings tab. Confirm the client ID matches the one you noted in Azure.
10. Paste the new secret value into the client secret field and select Save Changes.

✅

Set a calendar reminder or an Azure Policy alert about 30 days before the client secret expires. This gives you time to rotate it before the connector loses access.

Step 2: Review the Home dashboard

The Home dashboard gives you an immediate snapshot of privilege risk across your Entra ID and Azure RBAC environment. Before you drill into individual identities or accounts, the dashboard points you at the most pressing risk so you can focus your review. Security managers can also use the summary tiles to explain Azure privilege risk to stakeholders.

Steps

1. Sign in to app.beyondtrust.io. The BeyondTrust Home page displays.
2. At the top left, select the navigation menu icon, then select Insights. The Insights Home page displays.
3. Review the Identities by True Privilege summary. This tile shows the count and percentage of identities with Highest and High True Privilege. In an Azure estate, these are usually Global Administrators, Privileged Role Administrators, and users with broad Owner or Contributor assignments across subscriptions.
4. Note the four identity count tiles: Risky privileged identities, Identities with dormant accounts, Identities with escalations, and Identities with multiple providers. Each tile counts identities that need a closer look.
5. Select View Escalation Paths, or go to Entitlements, to see privilege escalation chains. Apply the Provider filter and select your Azure connector to show Azure escalation paths only.
6. Review Top 5 identities with the most accounts. In a hybrid environment, these are often users with both an on-premises Active Directory account synced to Entra ID and one or more cloud-native accounts. This is a common source of unintended privilege.

Reference: identity count tiles

Step 3: Review overprivileged identities

Azure identities gain privilege through Entra ID role assignments, group membership, and Azure RBAC inheritance. Ranking identities by True Privilege reveals who can reach Global Administrator or subscription Owner, including shadow administrators whose group or role memberships grant admin-level access without an explicit admin role. The Azure Portal does not show these escalation chains.

The Identities page ranks every user by True Privilege across all connected providers. Filter to your Azure connector to see which Entra ID users have the largest blast radius if compromised, including users overprivileged through group membership, RBAC inheritance, or Conditional Access exclusions.

Steps

1. Go to Insights > Identities. The Identities page displays all identities ranked by True Privilege.
2. Confirm the grid is sorted by True Privilege in descending order, with Highest first. This is the default sort order.
3. Review the Identities by True Privilege summary panel. Note the count of Highest and High privilege identities from your Azure connector. These are your priority candidates.
4. Apply a True Privilege filter and select Highest to see the identities that could reach Global Administrator-level access in your tenant.
5. Set Has Detections to Yes. This surfaces identities that combine high privilege with active security findings, which are the most urgent cases.
6. Apply the Dormant filter and set it to 60 days. This finds highly privileged identities that have not signed in recently. Attackers target these accounts, especially in organizations that have had staff changes.
7. Review the Accounts column. In an Azure estate, identities with a high account count often have both a synced on-premises account and cloud-native accounts. Check whether all linked accounts are still needed.
8. Select Download to export the filtered list as a .csv file for a formal privilege review or security report.

Reference: Identities page filters for an Azure review

Note

An identity's True Privilege in Azure can be much higher than what the Entra ID Portal shows. A user with only the User role can still have Highest True Privilege if they belong to an Entra ID group assigned the Global Administrator role, or if they own a group that grants admin access. True Privilege captures these indirect relationships. The portal does not.

Step 4: Investigate individual identities

Once you know which identities are high priority, the side panel gives you what you need to understand the risk and decide how to fix it. The True Privilege graph is especially useful in Azure. It makes visible the Entra ID group and Azure RBAC chains that let a seemingly low-privileged user reach Global Administrator or subscription Owner, which you cannot see in a single Azure Portal blade.

Overview

Selecting an identity opens a side panel with six tabs: Overview, Accounts, Detections, Recommendations, Entitlements, and Paths. For an Azure estate, the key tabs are Accounts, which shows every Entra ID and Azure account linked to this person, Entitlements, which shows the Azure RBAC and Entra ID roles that create elevated access, and Paths, which shows escalation chains in the True Privilege graph.

Steps

1. On the Identities page, select an identity name to open the side panel.
2. Review the Overview tab. Note the True Privilege level and whether the identity is flagged as a shadow administrator. Select View True Privilege Graph.
3. Open the Accounts tab. For each linked account, note the provider. Identify accounts in Azure tenants or subscriptions the identity no longer needs.
4. Open the Detections tab. Review the Azure detections for this identity. Look in particular for suspicious service principal changes, sign-ins from anonymized IP addresses, Conditional Access bypasses, and MFA fatigue.
5. Open the Recommendations tab. Common Azure recommendations include adding Conditional Access policies for the Azure AD Connector account, enrolling high-privilege accounts in Password Safe, and removing Global Administrator from accounts that no longer need it.
6. Open the Entitlements tab. Review the Azure RBAC roles, such as Owner, Contributor, and User Access Administrator, and the Entra ID directory roles, such as Global Administrator and Privileged Role Administrator, held by this identity's accounts.
7. Open the Paths tab, or select the True Privilege graph icon, to open the interactive node graph. Trace the escalation chains from the identity through its accounts and entitlements.
8. In the graph, look for choke points: Entra ID groups or Azure RBAC roles connected to many identities by orange escalation lines. These are your highest-value targets, because fixing one group or role assignment reduces privilege for many users at once.
9. Select any node to open its detail panel. An Entra ID group node shows the membership count and the entitlements granted. An Azure RBAC role node shows the scope, which can be a subscription, resource group, or resource, and the accounts assigned.

Reference: identity side panel tabs

Tab	What to look for in Azure	Key action
Overview	True Privilege level and the shadow administrator flag	Select View True Privilege Graph to inspect Entra ID and Azure RBAC escalation chains.
Accounts	Multiple Entra ID accounts, or Azure accounts in subscriptions the identity may no longer need	Flag accounts in Azure environments outside the identity's current scope of work.
Detections	Entra ID detections such as suspicious service principal changes, password spray, and MFA fatigue	Prioritize detections on Highest-privilege identities.
Recommendations	Azure guidance such as Conditional Access policies, Password Safe enrollment, and Global Admin removal	Track status on the Recommendations page in Step 8.
Entitlements	Azure RBAC roles such as Owner and Contributor, and Entra ID directory roles such as Global Administrator	Identify roles you can reduce in scope or remove.
Paths	Escalation chains, for example identity > Entra ID group > Azure RBAC role > subscription Owner	Find and record choke points to fix in Step 6.

Step 5: Review overprivileged accounts

In Azure, not every account belongs to an active, managed identity. Service accounts, legacy local accounts, and break-glass emergency accounts often sit outside normal identity governance. The Accounts page shows every account the Azure connector finds, including accounts not linked to any managed identity, so you can judge whether high-privilege accounts are justified, still in use, and properly controlled.

Overview

The Accounts page lists every account the Azure connector discovers, ranked by True Privilege. It shows account type, activation state, dormancy, key entitlements, active detections, and outstanding recommendations. Use it to find Azure accounts that are highly privileged but dormant, unmanaged, or outside your federated identity setup.

Steps

1. Go to Insights > Accounts. The Accounts page displays all accounts ranked by True Privilege.
2. Apply the Provider filter and select your Azure connector to show Entra ID and Azure accounts only.
3. Confirm the sort order is True Privilege descending, with Highest first. Review all Highest and High accounts before you move to Moderate.
4. Filter Account Type and review each category in turn. Start with service accounts and managed identities. These are common sources of excessive Azure privilege and are rarely covered by routine access reviews.
5. Apply the Dormant filter and set it to 60 days. Review high-privilege accounts that have not been used in 60 or more days for disablement, especially accounts outside your Entra ID-managed lifecycle.
6. Review the Detections column. Accounts with multiple detections, especially those with Highest True Privilege, are the most urgent. Select the count to see the detections.
7. Review the Key Entitlements column. Azure accounts with a high count of key entitlements may have gathered access across several subscriptions or resource groups over time.
8. Select an account name to open the side panel. Review the Detections, Entitlements, and Recommendations tabs. For accounts linked to an identity, select the True Privilege graph icon to see the full privilege chain.
9. Record any accounts you should disable, reduce in Azure RBAC scope, or onboard to BeyondTrust Password Safe for managed credential rotation.

Reference: Accounts page filters for an Azure review

Filter	Recommended value	What it surfaces in Azure
Provider	Your Azure connector	Restricts the view to accounts the Azure connector discovered.
True Privilege	Highest, then High	Entra ID accounts that can reach Global Admin or near-admin access.
Type	Service account, Managed identity, User	Separates non-human accounts, such as service principals and managed identities, from user accounts.
Dormant	60	Azure accounts inactive for 60 or more days, a common off-boarding gap.
State	Activated	Confirms you are reviewing live, active accounts.
Label	Dormant, External user	Surfaces labelled account categories that are common risk vectors in Azure.

Step 6: Review entitlements

Why this matters

In Azure, overprivilege usually comes from Entra ID directory roles and Azure RBAC role assignments rather than from permissions granted to individual accounts. A single overprivileged Entra ID group or RBAC role can be the root cause behind dozens of overprivileged identities. The Entitlements page lets you find these root causes, so you fix the source instead of the symptoms and reduce privilege for many users at once.

Overview

The Entitlements page lists every entitlement the Azure connector discovers, ranked by privilege level. For an Azure estate, that includes Entra ID directory roles such as Global Administrator, Privileged Role Administrator, and Security Administrator; Azure RBAC roles such as Owner, Contributor, and User Access Administrator; API permissions; and group memberships that confer elevated access. The Paths to Privilege graph shows the escalation chains that connect these entitlements to identities.

Steps

1. Go to Insights > Entitlements. Apply the Provider filter and select your Azure connector.
2. Confirm the page is sorted by Privilege descending, which is the default. Review all Highest-privilege entitlements first. In Azure these are usually Global Administrator, Privileged Role Administrator, and subscription-level Owner.
3. For each Highest-privilege entitlement, review the Accounts count. A role with a high account count has a large blast radius. Investigate any entitlement where the number of accounts looks higher than the business needs.
4. Apply the Type filter. Select Role to see Azure RBAC roles and Entra ID directory roles. Select Group member to see Entra ID security groups that grant elevated access. Select Permission to see app registrations and service principals with broad Microsoft Graph permissions.
5. Select an entitlement name to open the detail panel. Review the accounts assigned this entitlement, their source provider, and whether any are dormant or external.
6. For Highest and High-privilege entitlements, select the True Privilege graph icon to open the Paths to Privilege graph. Inspect the chains that connect accounts to the entitlement and identify choke points, which are groups or roles that grant access to many accounts at once.
7. Apply the Scope filter to narrow Azure RBAC results to a specific subscription, resource group, or resource. This is essential in large environments with many subscriptions.
8. Use the export settings to save a filtered PDF view for an access review report.

Reference: Azure entitlement privilege levels

Level	Azure examples	How to remediate
Highest	Global Administrator, Privileged Role Administrator, subscription-level Owner	Remove from every account that does not explicitly need it. Enroll the remaining holders in Password Safe.
High	Security Administrator, User Access Administrator, broadly scoped Contributor, Exchange Administrator	Confirm the business justification. Consider scoping RBAC roles to a specific resource group.
Moderate	Broadly scoped Reader, resource-scoped Contributor roles, Helpdesk Administrator	Check that the scope is appropriate and that Conditional Access policies apply.
Low	Standard group membership, scoped read permissions, license assignments	Low priority. Include in periodic access certifications.

Reference: key Azure entitlement types

Entitlement category	Description	What to look for
RBAC role (Azure)	Built-in or custom Azure roles assigned at subscription, resource group, or resource scope	Owner and User Access Administrator assigned at subscription scope. These carry the largest blast radius.
Role (Entra ID directory)	Built-in Entra ID directory roles such as Global Administrator and Privileged Role Administrator	Roles assigned to more accounts than needed. Check for permanent rather than PIM-eligible assignments.
Group member (Entra ID)	Membership of an Entra ID security group that carries Azure RBAC or directory role assignments	Groups with high-privilege RBAC assignments and many members. These are classic choke points.
API permission (Microsoft Graph)	Application or delegated Microsoft Graph permissions on app registrations	Broad permissions such as Directory.ReadWrite.All and RoleManagement.ReadWrite.All on externally accessible app registrations.

ℹ️

If your organization uses Azure Privileged Identity Management (PIM), entitlements in Insights may show both active and eligible role assignments, depending on how the connector is set up.

Review eligible assignments as carefully as active ones. In some PIM configurations, an eligible Global Administrator assignment can be activated without extra approval.

Step 7: Review detections

Why this matters

Azure detections in Insights go beyond what Entra ID Identity Protection surfaces on its own. Insights cross-correlates sign-in risk signals, configuration changes, unusual account behavior, and BeyondTrust product activity to give you a broader picture of active risk. A detection on an account with Highest True Privilege is your most urgent priority, because a compromise of that account could give an attacker Global Administrator access to your whole tenant.

Overview

The Detections page summarizes active risk findings across all connected providers. Filtered to your Azure connector, it shows Entra ID and Azure findings, including suspicious sign-in activity, service principal misuse, password attacks, dormant account activity, and unusual infrastructure changes. Detections are ranked by importance — Critical, High, Medium, and Low — and listed by discovery date by default.

Steps

1. Go to Insights > Detections. Apply the Provider filter and select your Azure connector.
2. Sort by Importance descending. Triage Critical and High detections before you address lower-severity findings.
3. Select a detection name to open the Overview panel. Read the full description: what triggered it, the concern it raises, and the recommended action.
4. Cross-reference detections with the Identities and Accounts pages. Select through from a detection to the affected account or identity to see its full privilege context before you decide how to respond.
5. For anomaly-based detections, which are AI-backed, read the detail carefully. These may describe unusual Azure infrastructure changes or unexpected service principal behavior that does not match a known attack signature. Decide whether the activity is legitimate in context.
6. Download the detection list as a .csv file to feed an incident response workflow, raise tickets in ServiceNow or Jira, or include in a security review report.

Reference: key Azure detections

Detection	Azure concern	Recommended action
Azure AD Connector account behaving strangely	The Entra Connect service account may be compromised. Tools such as AADInternals can extract its password from memory.	Investigate whether the account is compromised. Review recent Entra Connect activity logs.
Azure AD Identity Protection detected a privileged user login from an anonymized IP	A privileged account accessed over VPN or Tor may mean a compromise or intercepted credentials.	Investigate the sign-in. Use Conditional Access to block anonymized IP addresses for privileged accounts.
Azure AD Identity Protection detected a password spray attack	A password spray can compromise Entra ID credentials and lock out multiple accounts.	Investigate whether any accounts were compromised. Reset credentials for affected users.
Attacker obtained a user's password and attempted login via Azure AD	The user's password is likely compromised, and an attacker may have signed in from a different IP address.	Rotate the user's credentials immediately. Investigate sign-in activity around the time of the alert.
Suspicious changes to a service principal	An attacker may have modified a service principal as a backdoor after breaching your environment.	Audit the change. Confirm it was authorized and check for new credential assignments.
Sign-in with user agent used by Azure AD attack tools	The user agent string matches known Entra ID offensive tooling, so credentials may be compromised.	Have the user rotate their password. Investigate related activity for signs of compromise.
A potentially highly privileged IAM policy attached to a user	A high-privilege policy change may create privilege escalation or data exposure risk.	Review the change. Confirm it follows least privilege and was properly authorized.
Activity found on partially disabled identity	An identity with its Entra ID account disabled but other cloud accounts still active may mean off-boarding is incomplete.	Audit and disable all linked accounts for the off-boarded identity.
Successful MFA fatigue attempt identified	An attacker may have obtained the user's password and bypassed MFA by sending repeated push notifications.	Investigate whether the authentication was legitimate. Rotate credentials and review Conditional Access policies.

ℹ️

The Azure connector ingests Entra ID sign-in events and audit logs, and Azure Event Hub data if you set it up. You get richer anomaly-based detection coverage, particularly for service principal activity and infrastructure changes, when Azure Event Hub is set up with the full set of log categories: SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and ManagedIdentitySignInLogs.

Step 8: Review recommendations and remediate

Why this matters

Azure recommendations point at the specific Entra ID and Azure RBAC misconfigurations behind the privilege risk you found earlier. Tracking remediation status also creates an auditable record of your privilege posture improvements for compliance reporting and stakeholder updates.

Overview

The Recommendations page groups security posture guidance by type, ranked by importance and number of accounts affected. Common high-priority Azure recommendations cover the Azure AD Connector account, missing Conditional Access policies, unrotated passwords, dormant privileged users, and accounts Password Safe should manage. Users with the right permissions can update each recommendation's status and add comments.

Steps

1. Go to Insights > Recommendations. Apply the Provider filter and select your Azure connector.
2. Confirm the page is in Grouped view and sorted by Importance descending, which is the default. Review High-importance recommendations first.
3. Review the Accounts column. Recommendations that affect many accounts, such as MFA Not Enabled or Privileged user with an old, unrotated password, are often faster to fix with an Entra ID policy change than account by account.
4. Select a recommendation name to open the Recommendation Details page. Review the affected accounts, their True Privilege levels, and their providers.
5. Select Quick View on any row for a high-level summary before you decide whether to act on it.
6. Select an account name to open the Instance Details page. This shows the full description, the importance level, the underlying Azure concern, and the resolution steps.
7. Select one or more accounts, then select Update Status. Choose a status: New, In Progress, Resolved, False Positive, or Ignored.
8. Add a comment to record what you did, for example a ServiceNow or Jira ticket reference, the name of the engineer who did the work, or the reason for marking an item as a false positive.
9. Select Update Status to save. Insights keeps the status and comment history for audit purposes.
10. After you finish a round of remediation, export the Recommendations grid as a .csv file for reporting or for your ticketing system.

Reference: key Azure recommendations

Recommendation	Azure concern	Suggested resolution
Overprivileged Azure AD Connector account	The Entra Connect service account has Global Administrator, which Entra Connect no longer needs to work.	Remove the Global Administrator role from the Azure AD Connector account.
Azure AD Connector account not protected by Conditional Access Policies	Without a Conditional Access policy, a stolen Entra Connect credential can be used from any location.	Add a Conditional Access policy that restricts the connector account to its source server IP address.
Entra Connect account not managed by Conditional Access policies	Entra Connect accounts without a Conditional Access policy can be abused from attacker infrastructure using stolen credentials.	Add a Conditional Access policy. This is a separate recommendation from the classic Azure AD Connector account.
MFA Not Enabled	Interactive Entra ID accounts without MFA are at high risk if credentials leak.	Turn on MFA for all interactive accounts in Entra ID > Security > Authentication methods.
Privileged user with an old, unrotated password	Privileged accounts with passwords older than a year are more likely to have been exposed.	Use Password Safe to manage and rotate passwords for privileged Entra ID accounts.
Privileged Azure AD account not managed by Password Safe	High-privilege accounts outside Password Safe have unmanaged credentials and a higher risk of compromise.	Onboard the account to Password Safe for automated credential management.
Identity with dormant accounts	Dormant Entra ID accounts add unnecessary attack surface, especially if the identity has left the organization.	Disable dormant accounts in Entra ID. Confirm with the identity's manager before you disable service accounts.
Partially-revoked identity	Off-boarding is incomplete: the primary Entra ID account is disabled but secondary cloud accounts are still active.	Audit and disable every account linked to the identity across your Azure estate.
Privileged user not in the Protected Users group	The Protected Users group adds safeguards against credential theft for privileged accounts.	Add interactive privileged users to the Protected Users group. Do not add non-interactive service accounts.

Reference: recommendation status values

Status	Meaning	When to use it
New	The default. Not yet reviewed.	Leave as New until you start investigating.
In Progress	Remediation has started but is not finished.	Set this when you raise a ticket or start an Entra ID or Azure RBAC change.
Resolved	The underlying misconfiguration is corrected.	Set this after you confirm the change is in place, for example a Conditional Access policy applied, a role removed, or an account disabled.
False Positive	The recommendation does not apply to this account in context.	Use for accepted configurations, for example a break-glass Global Admin account intentionally excluded from MFA.
Ignored	Acknowledged but intentionally not actioned.	Use for accepted risks that have a documented business justification and management sign-off.

✅

If your organization uses Microsoft Sentinel, Insights supports a Microsoft Sentinel webhook integration that forwards detections to Sentinel as security alerts. This lets your security operations team triage Insights findings inside their existing investigation workflow. See the Integrations section of the Insights documentation for setup steps.

Verify the results

Verify that the Microsoft Azure connector shows a status of enabled on its Overview page and that Azure identities, accounts, and entitlements appear on the Identities, Accounts, and Entitlements pages.

• Confirm that every Highest-privilege identity and entitlement you reviewed has either a documented business justification or a recommendation set to In Progress or Resolved.
• Confirm that your exported .csv and PDF files record the state of the estate at the time of the review.

Next steps

Overprivilege in an Azure estate is a continuous problem, not a one-time event. Entra ID group memberships accumulate, Azure RBAC role assignments persist after projects end, and new accounts are not always created to a least-privilege standard. Set a regular cadence for this review.

• Schedule the next privilege review and compare your Highest and High privilege counts against this one.
• Set a calendar reminder 30 days before the BT-SP-Connector client secret expires.
• Onboard the privileged Azure accounts you identified into BeyondTrust Password Safe for managed credential rotation.
• Set up the Microsoft Sentinel webhook integration so your security operations team receives Insights detections.

Related resources

• BeyondTrust Insights documentation
• Microsoft: Stream Microsoft Entra logs to an Azure event hub
• Microsoft: Install Azure PowerShell