All projects

Who can do damage here? A monthly answer, cloud and on-prem

May 2026 2 min read

  • Entra ID
  • PIM
  • Active Directory
  • Logic Apps
Privileged access report, cloud and on-premisesCloudOn-premisesLogic Appmonthly scheduleGraph · PIMeligible + active rolesMail connectorauthorised by a personScheduled taskmonthly, PowerShellActive Directoryprivileged groupsApp identity + certlimited to one mailboxSame report✉Two trust models: the on-premises sender cannot reach any other mailbox; the cloud one inherits a person’s rights.

Every audit, every incident review, every new security lead asks the same question first: who has admin rights? In a hybrid estate the honest answer is “it depends which directory you mean”, and then somebody spends an afternoon exporting group memberships.

I wanted that afternoon to happen by itself, on the first of every month, and land in the right inbox.

What the report says

One mail, two sections. Entra ID: every role assignment in Privileged Identity Management, eligible and active, with who holds it and since when. Active Directory: every member of the privileged groups on-premises, nested groups flattened. And at the top of each, the part people actually read: what changed since last month. New admin, removed admin, role that went from eligible to permanently active.

Nobody has to ask. If a name appears that shouldn’t, it’s noticed in days, not at the next audit.

Two halves, two trust models

The cloud half is a Logic App: runs on a schedule, reads PIM through Microsoft Graph, sends the mail through the Office 365 connector. The on-premises half is a scheduled PowerShell task: reads Active Directory, sends the mail as an application identity that authenticates with a certificate.

Drawing them side by side showed something worth writing down. The on-prem sender is locked to one mailbox by an Exchange application access policy: if its certificate leaked, the attacker could send that one report and nothing else. The cloud connector, by contrast, was authorised once by a person and inherits everything that person can do, and it silently breaks the day their account changes. The weaker of the two was the one running in the cloud. That half is on the list to move to a managed identity.

What you could take from this

The pattern is small and portable: a schedule, a read-only query on each directory, a diff against last month’s export, and a sender that can only do one thing. If you run a hybrid tenant and nobody gets a mail like this, it’s a week of work to change that.

All projects