// tools/access-map

Access Map

See who can do what across Microsoft Entra and Azure in one place: PIM-eligible and active Entra roles, Azure role assignments from management group down to single resources, and everyone who gets access through a group. It flags standing admin access, too many Global Administrators, guests and automation with admin rights, and gives you the commands to fix each one.

The script only reads. Its output is read in your browser and never uploaded.

Download the script. Get-AzureBlogAccessMap.ps1 It reads Entra role eligibility and assignment schedules from Microsoft Graph, Azure role eligibility and assignments from every subscription you can see, and the members of every group that holds a role, including nested groups and PIM for Groups eligible members. It changes nothing.

Run it in PowerShell 7 as someone who can read roles (Global Reader is enough for Entra) with Reader on the subscriptions:

powershell3 lines

1
2
3Install-Module Microsoft.Graph.Authentication, Az.Accounts -Scope CurrentUser   # first time only
.\Get-AzureBlogAccessMap.ps1
# options: -TenantId <guid>  -SubscriptionFilter 'Prod-*'  -SkipAzure  -SkipEntra  -SkipGroupExpansion

Load the result here. It saves azureblog-access-map-<date>.json, plus a flat CSV for Excel. The JSON holds names, sign-in names, role names and scopes, so treat it as sensitive and delete it when you're done.

Drop your azureblog-access-map-….json file here

choose file

What it checks

Finding	Rule
Standing privileged access	A person holds a privileged role permanently instead of as PIM-eligible, directly or through a group. Critical for Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Owner, User Access Administrator and Role Based Access Control Administrator. Accounts named as break-glass or emergency access are left out.
Too many Global Administrators	Five or more people or apps can be Global Administrator, eligible or active, including through groups. Microsoft recommends fewer than five.
Guests with admin access	A guest account (`#EXT#`) holds a privileged Azure role or any Entra role.
Automation that can grant access	A service principal holds Owner, User Access Administrator or Role Based Access Control Administrator, or a top Entra role.
Owner or Contributor across management groups	A standing Owner, Contributor, User Access Administrator or RBAC Administrator assignment at a management group, inherited by every subscription below.
Roles assigned to deleted identities	An assignment whose user, group or app no longer exists.
Admin rights through nested groups	Someone gets a privileged role from a group that's a member of the role-holding group.
Ending in the next 14 days	Eligible or time-bound assignments due to lapse within two weeks of the export.
Eligible with no end date	Privileged eligible assignments that never expire.

The privileged role list follows Microsoft's privileged role labels and the Azure roles that can change resources or grant access. Look up any role in built-in roles explained, or find a smaller one with the least-privilege role finder. The sample tenant is made up: contoso.com and every name in it are fictional.