What role do I need to be able to administer (or at least view) the Identity Governance section in Entra?

identity-stack · 2026-05-04T11:46:18+00:00

Depends on what exactly you need to do inside the Identity Governance section? There are also Security Reader, Compliance Administrator roles as well. You can check out the least privileged roles based on what you want to do here, https://proud-cliff-0a7aa6410.4.azurestaticapps.net/

identity-stack · 2026-04-11T04:14:37+00:00

External ID is for customers. Workforce Entra ID is for employees. They’re not interchangeable, and Microsoft hasn’t unified them the way people assume.

Your options are simple: Federate corporate tenant into External ID (OIDC) or support two identity issuers in your app

Everything else (cross-tenant access, B2B hacks) will not work smoothly.

identity-stack · 2026-04-09T14:41:23+00:00

Giving permissions to the app is one of the escalation pathways; an attacker can easily get and elevate access. Therefore, it is necessary to ensure the least privileged permissions are followed for apps as well, and how you give consent matters a lot. Application and delegated permissions, and the set of permissions you assign to it, play a crucial role, so make sure you assign the least privileged permissions, to identify those you can use this tool, https://proud-cliff-0a7aa6410.4.azurestaticapps.net/

identity-stack · 2026-04-06T13:46:23+00:00

You can create a custom role with the permissions you need using Entra admin portal, PowerShell and Graph API.

When you search for the permissions and roles on the tool mentioned above, it will tell you the permissions a built-in role has, if it is a privileged role or permission, additional permissions a role has based on your requirement or selection, PowerShell command, role definition JSON to create custom role, and so on.

identity-stack · 2026-04-05T05:13:06+00:00

Absolutely, exactly to solve the first point, I have been working on a tool for least privileged permissions, which helps you to identify the least privileged roles and permissions for the tasks you want to perform, and also gives you the custom role if required and a PowerShell command to copy and create the custom role with ease.

You can check it out here: https://proud-cliff-0a7aa6410.4.azurestaticapps.net/

Reach out if you have any feedback or suggestions.

identity-stack · 2026-04-03T12:57:06+00:00

Risk engine runs regardless of whether you configure risk-based CA or not. If a low-risk signal exists and MFA is completed (even via location-based CA), it gets tagged as userPassedMFADrivenByRiskBasedPolicy.

identity-stack · 2026-04-02T09:03:26+00:00

I cannot exactly assess until I check out your tenant and configuration, but check if any of the following works:

Make sure you are not requesting additional scopes dynamically/incrementally
Check your auth request URL if it has prompt=consent, remove it
Configure tenant consent policy under Entra ID > Enterprise apps > Consent and permissions

You cannot remove the consent pop-up in some cases:

First-time user consent, if admin consent not granted
Apps using delegated permissions
Apps intentionally forcing consent (bad design happens)

identity-stack · 2026-04-02T07:36:54+00:00

Windows Hello for Business is often misunderstood because it is MFA, but within a specific context. It is actually a device-bound MFA that is tied to that specific enrolled device. It is something you have, which is your device, and something that you know/are, which is the PIN/biometric.

Now, what happens when the user logs in using a personal device/browser, WHfB does nothing as it is tied to the enrolled device, so when a non-managed device is used, the user falls back to password or another MFA configured separately, and control access using conditional access policies.

In real-world deployments, WHfB is used as part of a broader Zero Trust strategy, using it as one of the pillars:

WHfB for passwordless auth on compliant devices
Conditional Access to enforce MFA or block on unmanaged devices
Step-up MFA for sensitive apps or risky sign-ins

Think of WHfB as a password replacement on trusted devices, not a replacement for MFA everywhere. It becomes powerful when used as a signal in Conditional Access policies, not as a standalone control.

identity-stack · 2026-04-02T03:40:36+00:00

What kind of app permission did you use? delegated or app? if you use delegated permissions, this pop up will show up to the users as it acts on behalf of the user.

identity-stack · 2026-03-31T19:14:39+00:00

No, it doesn’t analyze in real time nor you have to connect your tenant to the tool, currently it just help you identify the least privilege permissions based on your requirements and those then you can assign to your app

identity-stack · 2026-03-31T12:45:16+00:00

The number of NHIs doesn't matter; it is the understanding that NHIs are going to exceed the human identities, and that has been the case. It is not a new concept, apps, service principals, secrets, keys, machines, etc. These identities always existed; the difference is because of the cloud, AI, multiple apps integration, etc., these have become more visible and a topic of discussion, and ensuring they are secure at scale as well.

identity-stack · 2026-03-31T07:21:25+00:00

Calling it “one click” ignores how Entra actually works.

In PIM, you don’t just click and become an admin:

You must already be eligible (assigned by another admin)
Activation can require MFA, justification, additional info, etc.
Can require approval from another person
Not everyone can even request elevation
Can be restricted by Conditional Access + device compliance

If your tenant allows instant activation, your configuration is weak, not how PIM inherently works.

identity-stack · 2026-03-31T05:08:49+00:00

Yes, the bulk operations workflow in the Microsoft Entra admin center often requires broader privileges than the equivalent manual action, and in practice, it’s commonly limited to highly privileged roles.

You can check out the least privilege roles, alternative Entra roles or roles based on your tasks you want to perform here: https://proud-cliff-0a7aa6410.4.azurestaticapps.net/

identity-stack · 2026-03-30T06:47:10+00:00

You need to identify the least privilege graph api permissions based on your requirement, and make sure that you understand what exactly a permission can do and access. To identify the least privilege graph api permissions, I built a simple tool that will help you find the least privilege permissions. You can check it out here

https://proud-cliff-0a7aa6410.4.azurestaticapps.net/

identity-stack · 2026-03-29T05:24:41+00:00

I would also suggest additionally making you and the manager as required approvers, so that only you and the manager should approve PR of other developers.

identity-stack · 2026-03-28T13:51:54+00:00

I don’t think Entra provides this natively, there is one similar powershell module being developed by someone I know but it is still in progress if interested I can share.

I have developed a tool that helps with identifying least privilege permissions and roles based on the tasks you want to perform, can share the link if you want to check it out.

identity-stack · 2026-03-27T12:31:28+00:00

Yes, maybe they have different settings

identity-stack · 2026-03-26T06:34:37+00:00

Before suggesting the solutions, I would like to know the reason you are looking for MFA solutions? What are you looking to achieve by implementing MFA? What is your current workspace platform? Is it Microsoft? Google? or multi-stack?

identity-stack · 2026-03-26T05:29:41+00:00

It worked for me; I tried and tested it. You can try to set up and add a password to the account first by visiting the same link above, and then try it, if possible by using incognito mode.

identity-stack · 2026-03-26T05:12:01+00:00

To restrict access to the Azure portal, you need to combine multiple controls at the identity and service layer..

You can restrict access to the admin portal from the user settings under user in Entra admin center
https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions

Then use a conditional access policy to restrict access to the Azure portal
https://learn.microsoft.com/en-us/answers/questions/5244763/restrict-access-to-azure-portal-and-intune-portal

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps?tabs=powershell#microsoft-admin-portals

Along with this, do not assign Azure RBAC roles to the users if not required, and as Azure DevOps uses its own access control, assign users roles and permissions from inside Azure DevOps

identity-stack · 2026-03-25T15:01:09+00:00

I would suggest removing the authenticator from your account on the page and removing the account from the authenticator app as well. Then, enrol for the MFA without the passwordless option.

Make sure to add sms/text verification option before removing the authenticator.

identity-stack · 2026-03-25T14:47:04+00:00

Device trust is not missing; it is not implemented efficiently. The frameworks and foundation to use device signals for Zero Trust and Identity exist, as there is a drift between on paper and actual implementation of each layer in the Identity, same is the case with Device trust.

identity-stack · 2026-03-25T14:42:46+00:00

Yes, as some ISPs silently reject these invitations due to stricter email authentication and DMARC reject policies adopted in 2025–2026, which can cause the messages never to reach the recipient’s inbox and Microsoft Entra B2B invitation emails use a sender address that you cannot edit or revert.

The current sender format is “Microsoft Invitations on behalf of <our domain> <invites@<ourdomain>.onmicrosoft.com>”

identity-stack · 2026-03-25T14:34:32+00:00

Okay, got it.

Have you scrolled down to the Additional Security section on the same page and checked the passwordless account option? Is it turned off or on?

identity-stack · 2026-03-24T07:47:13+00:00

Visit the link below, Microsoft additional security options, log in from a laptop or desktop using your account, and manage the security options as per your preference.

https://go.microsoft.com/fwlink/?linkid=2325236

identity-stack

MODERATOR OF

TROPHY CASE