#Entra ID
5 posts
Entra ID Automation #5 PIM and Auditing: Killing Standing Admins, Logs, and Access Reviews
The track finale on privilege and accountability: the PIM structure that replaces standing admin rights with eligibility and time-boxed activation, Graph roleEligibilityScheduleRequests and the self-activation API, the pattern combining role-assignable groups with PIM, pulling audit and sign-in logs through the API to alert on high-risk events, automating periodic access reviews, and the adoption order for everything in this track.
Entra ID Automation #4 Conditional Access: Managing Policy as Code
The sign-in-moment defense line, from an automation angle: the if-then structure of signals, decisions, and enforcement, CRUD on policies through the Graph conditionalAccess endpoint, the policy-as-code flow of source control, review, and CI deployment, why every new policy must run in report-only mode first, the rule that break-glass accounts are excluded from every policy, and the 30-day restore window for accidentally deleted policies.
Entra ID Automation #3 Group Design: Dynamic Groups, Group-Based Licensing, Access Packages
Designing groups — the unit of access management — for automation: when to use security groups versus Microsoft 365 groups, dynamic groups whose membership is computed from attribute rules and their P1 licensing, rule syntax and processing delays as operational realities, group-based licensing that automates assignment and reclamation on entry and exit, the security boundary of role-assignable groups, and access packages that productize self-service access requests.
Entra ID Automation #2 The User Lifecycle: Creation, Disabling, and Lifecycle Workflows
Handling joiners, movers, and leavers in code: why attribute standardization matters when creating users through the Graph API, delivering initial credentials with a Temporary Access Pass, why offboarding starts with disabling rather than deletion and how the 30-day soft delete works, why group-based licensing beats per-user assignment, and the product features that package the whole flow — Entra lifecycle workflows and HR-driven provisioning.
Entra ID Automation #1 The Big Picture: Tenants, Directory Objects, and the JML Lifecycle
First post in a series on automating Microsoft Entra ID administration with code: where Entra ID (renamed from Azure AD) sits, the structure of a tenant and its directory objects — users, groups, apps, devices — the joiner-mover-leaver (JML) model that forms the backbone of account automation, the tooling landscape across Graph API, PowerShell, and IaC, and how features map to the Free, P1, P2, and Governance license tiers.