Designing on-premises and cloud audit reports for privileged accounts
- The problem
- "Who has admin rights?" took an afternoon of exports to answer, in two directories.
- What I built
- Two monthly automations, cloud and on-premises, producing one encrypted report with a diff.
- What came of it
- A new or changed admin is noticed in days, not at the next audit.
Every audit, every incident review and every new security lead opens with the same question: who has admin rights? In a hybrid estate the honest answer is “it depends which directory you mean”, followed by somebody spending an afternoon exporting group memberships.
That afternoon should happen by itself, on the first of every month, and land in the right inbox. This is the shape that has worked for us: not the only way to solve it, but one that runs unattended and lands on schedule, the first of every month.
Report the change, not just the state
One mail, two sections.
Entra ID: every PIM role assignment, eligible and active, read through Graph by a Logic App.
Active Directory: every member of the privileged groups, nested groups flattened, read by a scheduled script with a certificate.
What changed: the diff against last month’s export, at the top of each section. The three lines people actually read.
Entra ID: every role assignment in Privileged Identity Management, eligible and active, with who holds it and since when. Active Directory: every member of the privileged groups on-premises, with nested groups flattened, because a report that lists a group instead of the people inside it is not an answer, it is a second query.
At the top of each section sits the part people actually read: what changed since last month. New admin, removed admin, a role that moved from eligible to permanently active.
That last transition is the one worth designing for. A full membership list is a wall of names that nobody checks line by line; a three-line diff is read every time. If a name appears that should not be there, it is noticed within days rather than at the next audit.
Two halves, one report
The cloud half is a Logic App on a schedule: it reads PIM through Microsoft Graph and compares the result against last month’s export. The on-premises half is a scheduled PowerShell task doing the same against Active Directory, authenticating with a certificate rather than a stored password.
Both produce the same shape of report, and both send it encrypted. This is not optional decoration: the mail contains a complete list of every privileged account in the company, which is precisely the document you do not want readable in transit or forwarded by accident to a distribution list.