Azure Centric ยท Identity & accessPosts, a podcast and video series about Microsoft Azure by Marcos Nogueira.https://azurecentric.com/Build a repeatable privileged-access reviewhttps://azurecentric.com/posts/build-a-repeatable-privileged-access-review/https://azurecentric.com/posts/build-a-repeatable-privileged-access-review/Use role-assignable groups and PIM to manage privileged access reviews, ensuring clear separation between group membership and role eligibility.Wed, 16 Sep 2026 00:00:00 GMTidentity-accessmicrosoft-entra-idaccess-reviewsprivileged-identity-managementUse group-based administration without hiding excessive accesshttps://azurecentric.com/posts/use-group-based-administration-without-hiding-excessive-access/https://azurecentric.com/posts/use-group-based-administration-without-hiding-excessive-access/Create role-assignable groups deliberately: understand immutability, membership restrictions, and privilege elevation risks.Sat, 25 Jul 2026 00:00:00 GMTidentity-accessmicrosoft-entra-idgroupsprivileged-identity-managementInvestigate an unexpected Conditional Access resulthttps://azurecentric.com/posts/investigate-an-unexpected-conditional-access-result/https://azurecentric.com/posts/investigate-an-unexpected-conditional-access-result/Resolve unexpected Conditional Access outcomes by correlating sign-in logs with the What If tool to identify policy application and conditions.Wed, 03 Jun 2026 00:00:00 GMTidentity-accessmicrosoft-entra-idconditional-accesstroubleshootingsign-in-logswhat-if-toolReview application consent and service principal permissionshttps://azurecentric.com/posts/review-application-consent-and-service-principal-permissions/https://azurecentric.com/posts/review-application-consent-and-service-principal-permissions/How to review and revoke permissions for enterprise applications in Microsoft Entra ID, including admin and user consent.Wed, 08 Apr 2026 00:00:00 GMTidentity-accessmicrosoft-entra-idconsentpermissionspowershellPlan identity permissions for a production deployment pipelinehttps://azurecentric.com/posts/plan-identity-permissions-for-a-production-deployment-pipeline/https://azurecentric.com/posts/plan-identity-permissions-for-a-production-deployment-pipeline/Scope Entra ID roles to app registrations and apply Conditional Access to pipeline service principals.Wed, 11 Feb 2026 00:00:00 GMTidentity-accessmicrosoft-entra-iddeployment-pipelineconditional-accessworkload-identitiesrbacUse Conditional Access authentication strengths carefullyhttps://azurecentric.com/posts/use-conditional-access-authentication-strengths-carefully/https://azurecentric.com/posts/use-conditional-access-authentication-strengths-carefully/Enforce specific authentication strengths for external users by configuring cross-tenant MFA trust and applying Conditional Access policies in report-only mode.Sat, 20 Dec 2025 00:00:00 GMTidentity-accessconditional-accessmicrosoft-entra-idauthentication-strengthsmultifactor-authenticationcross-tenant-accessexternal-usersReview guest access before sharing an Azure applicationhttps://azurecentric.com/posts/review-guest-access-before-sharing-an-azure-application/https://azurecentric.com/posts/review-guest-access-before-sharing-an-azure-application/Restrict guest directory visibility, enforce MFA via Conditional Access, and automate cleanup using Access Reviews.Mon, 27 Oct 2025 00:00:00 GMTidentity-accessmicrosoft-entra-idguest-accessmultifactor-authenticationconditional-accessaccess-reviewsTroubleshoot a managed identity that cannot reach a resourcehttps://azurecentric.com/posts/troubleshoot-a-managed-identity-that-cannot-reach-a-resource/https://azurecentric.com/posts/troubleshoot-a-managed-identity-that-cannot-reach-a-resource/Troubleshoot managed identity access failures by verifying assignment, checking control-plane state, and confirming RBAC scope.Thu, 04 Sep 2025 00:00:00 GMTidentity-accessmicrosoft-entra-idmanaged-identitiestroubleshootingrbacRequire stronger authentication for privileged operationshttps://azurecentric.com/posts/require-stronger-authentication-for-privileged-operations/https://azurecentric.com/posts/require-stronger-authentication-for-privileged-operations/Plan for mandatory Azure MFA enforcement and configure phishing-resistant authentication for privileged roles.Sun, 13 Jul 2025 00:00:00 GMTidentity-accessmicrosoft-entra-idmultifactor-authenticationconditional-accessautomationDecide where Azure RBAC assignments should livehttps://azurecentric.com/posts/decide-where-azure-rbac-assignments-should-live/https://azurecentric.com/posts/decide-where-azure-rbac-assignments-should-live/Decide whether to assign Microsoft Entra roles at tenant, application, or administrative unit scope to match the boundary of the user's responsibility.Sun, 18 May 2025 00:00:00 GMTidentity-accessmicrosoft-entra-idrbacadministrative-unitsRun an access review for privileged group membershiphttps://azurecentric.com/posts/run-an-access-review-for-privileged-group-membership/https://azurecentric.com/posts/run-an-access-review-for-privileged-group-membership/Run access reviews on role-assignable groups to validate privileged membership and remove stale assignments.Sun, 23 Mar 2025 00:00:00 GMTidentity-accessaccess-reviewsmicrosoft-entra-idprivileged-identity-managementSeparate Azure control-plane roles from data-plane permissionshttps://azurecentric.com/posts/separate-azure-control-plane-roles-from-data-plane-permissions/https://azurecentric.com/posts/separate-azure-control-plane-roles-from-data-plane-permissions/Clarify that Microsoft Entra ID roles and Azure RBAC are separate systems. Assign permissions in each plane independently.Thu, 23 Jan 2025 00:00:00 GMTidentity-accessmicrosoft-entra-idrbacprivileged-accessrbac-separationInvestigate a failed sign-in using Entra logshttps://azurecentric.com/posts/investigate-a-failed-sign-in-using-entra-logs/https://azurecentric.com/posts/investigate-a-failed-sign-in-using-entra-logs/Investigate a failed Entra sign-in by isolating error codes, checking CA status, and using the Diagnostics tool.Sun, 01 Dec 2024 00:00:00 GMTidentity-accesstroubleshootingmicrosoft-entra-idsign-in-logsconditional-accessmultifactor-authenticationConnect GitHub Actions to Azure using OpenID Connecthttps://azurecentric.com/posts/connect-github-actions-to-azure-using-openid-connect/https://azurecentric.com/posts/connect-github-actions-to-azure-using-openid-connect/Secure GitHub Actions to Azure using OIDC federation and Microsoft Entra Conditional Access for workload identities.Mon, 30 Sep 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idgithubworkload-identity-federationgithub-actionsopenid-connectconditional-accessPrepare Azure administrators for mandatory multifactor authenticationhttps://azurecentric.com/posts/prepare-azure-administrators-for-mandatory-multifactor-authentication/https://azurecentric.com/posts/prepare-azure-administrators-for-mandatory-multifactor-authentication/Prepare Azure administrators for mandatory multifactor authentication (MFA) enforcement starting October 2024.Mon, 19 Aug 2024 00:00:00 GMTidentity-accessmultifactor-authenticationmicrosoft-entra-idconditional-accessReplace a service principal secret with workload identity federationhttps://azurecentric.com/posts/replace-a-service-principal-secret-with-workload-identity-federation/https://azurecentric.com/posts/replace-a-service-principal-secret-with-workload-identity-federation/Replace service principal secrets with workload identity federation by linking an external OIDC provider to an Azure managed identity.Mon, 05 Aug 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idworkload-identity-federationmanaged-identitiestroubleshootingUse Privileged Identity Management for Azure administrationhttps://azurecentric.com/posts/use-privileged-identity-management-for-azure-administration/https://azurecentric.com/posts/use-privileged-identity-management-for-azure-administration/Use Microsoft Entra Privileged Identity Management to manage Azure administration with just-in-time access and audit trails.Thu, 13 Jun 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idprivileged-identity-managementazure-administrationmultifactor-authenticationemergency-accessChoose system-assigned or user-assigned managed identitieshttps://azurecentric.com/posts/choose-system-assigned-or-user-assigned-managed-identities/https://azurecentric.com/posts/choose-system-assigned-or-user-assigned-managed-identities/Compare system-assigned and user-assigned managed identities to decide which fits your workload lifecycle and permission requirements.Sun, 21 Apr 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idmanaged-identitiesCreate and test emergency access accounts in Microsoft Entra IDhttps://azurecentric.com/posts/create-and-test-emergency-access-accounts-in-microsoft-entra-id/https://azurecentric.com/posts/create-and-test-emergency-access-accounts-in-microsoft-entra-id/Create cloud-only emergency administrators, choose independent authentication, monitor their use and test the recovery process without disrupting normal access.Sun, 25 Feb 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idemergency-accessauthenticationconditional-accessRoll out Conditional Access using report-only modehttps://azurecentric.com/posts/roll-out-conditional-access-using-report-only-mode/https://azurecentric.com/posts/roll-out-conditional-access-using-report-only-mode/Build a small Conditional Access pilot, read report-only sign-in results correctly, and check the effect of other policies before enforcing MFA.Fri, 05 Jan 2024 00:00:00 GMTidentity-accessmicrosoft-entra-idconditional-accessmultifactor-authentication