Tag: app-registrations
All the articles with the tag "app-registrations".
Restricted Management AUs in Entra ID: two undocumented paths that actually work
Updated:Restricted Management Administrative Units contain a service principal holding Application.ReadWrite.All — but the design depends on three configurations Microsoft does not document. All three tested against a live tenant with az rest.
Restricted Management AUs in Entra ID break Entitlement Management and PIM. Here's how to fix it.
Microsoft says Entra ID Governance can't manage objects inside a Restricted Management AU. It can, once you scope a role to the right first-party service principal. Entitlement Management, PIM for Groups and Lifecycle Workflows, tested fail → scope → works in a live tenant.
Your Entra ID protected action has a gap
Protected actions lock hard-delete for users. Then you call the same action from an app and it sails straight through. Here is exactly where the wall is, and where it isn't, tested against a live tenant.