Field notes
RSS FeedFindings from building and securing identity platforms on Microsoft Entra ID and Azure. Configurations that behave unexpectedly, permission models that don't match their documentation, and the occasional genuine security gap — written up with the reproduction steps.
Everything here was encountered directly and verified. Where a conclusion is provisional, the post says so.
Featured
Restricted Management AUs in Entra ID: two undocumented paths that actually work
Updated:Restricted Management Administrative Units contain a service principal holding Application.ReadWrite.All — but the design depends on three configurations Microsoft does not document. All three tested against a live tenant with az rest.
Your Entra ID protected action has a gap
Protected actions lock hard-delete for users. Then you call the same action from an app and it sails straight through. Here is exactly where the wall is, and where it isn't, tested against a live tenant.
Recent Posts
Restricted Management AUs in Entra ID break Entitlement Management and PIM. Here's how to fix it.
Microsoft says Entra ID Governance can't manage objects inside a Restricted Management AU. It can, once you scope a role to the right first-party service principal. Entitlement Management, PIM for Groups and Lifecycle Workflows, tested fail → scope → works in a live tenant.