Privileged access review Early access

See who holds privileged roles in your tenants, and which assignments can be removed.

TenantFlex reads every privileged role assignment across Azure, Entra ID and Okta, gives each one a verdict, and scores the tenant's posture. You get a change bundle to run yourselves. The review never writes to the tenant.

Ask for early access
Microsoft Entra IDOktaPingOneadditional IdPs on request
Read only · apply.sh · rollback.sh · adopt.tf
What the review does

Every privileged role, one verdict each, one score.

  • Every privileged role, in one reviewAzure RBAC at management group, subscription and resource group scope. Entra ID directory roles, active and PIM-eligible. Okta admin roles, standard and custom, held directly or through a group.
  • A verdict for each assignmentEvery removal is proved from the tenant's own structure: an assignment already inherited from a parent scope, covered by a broader role the same principal holds, or held by a principal that no longer exists. Anything that cannot be proved is kept and flagged for review.
  • A posture score you can compare0 to 100, with every deduction named: standing privilege, too many tenant admins, privileged guests, unused custom roles, no recent sign-in. Each scan shows what changed since the last one.
  • Checked against Microsoft and Okta guidanceGlobal Administrator and Super Administrator counts, guest and on-premises-synced admins, standing privilege outside PIM, and phishing-resistant MFA for admin accounts.
  • You make the changeThe bundle holds apply and rollback scripts with a dry run and a tenant guard, refuses to remove a scope's last owner, and adds Terraform import blocks for the assignments you keep.

What it reads

Entra ID
RoleManagement.Read.DirectoryRoleAssignmentSchedule.Read.Directory
Azure
A read-only role at the root management group
Okta
okta.roles.readokta.users.readokta.groups.read

Nothing that can write.

Who holds the keysEvery privileged role assignment in a tenant, read in one pass, from global administrators down to read-only roles. Example counts.
TenantFlex Get started

Ask for early access.

Tell us which of Azure, Entra ID and Okta you run and roughly how many admins you expect. We will run the first review with you.

team@tenantflex.com · www.tenantflex.com
Ask for early accessWe reply within one business day.

Goes straight to team@tenantflex.com. If the form can't reach us, it opens your email app with the request prefilled instead.

Click image to zoom · ← → to browse · Esc to close