Tag: identity-governance

All the articles with the tag "identity-governance".

• Restricted Management AUs in Entra ID: two undocumented paths that actually work

  Updated:24 Sep, 2026

  Restricted Management Administrative Units contain a service principal holding Application.ReadWrite.All — but the design depends on three configurations Microsoft does not document. All three tested against a live tenant with az rest.

• Restricted Management AUs in Entra ID break Entitlement Management and PIM. Here's how to fix it.

  24 Sep, 2026

  Microsoft says Entra ID Governance can't manage objects inside a Restricted Management AU. It can, once you scope a role to the right first-party service principal. Entitlement Management, PIM for Groups and Lifecycle Workflows, tested fail → scope → works in a live tenant.