Topic starter
25/06/2026 1:25 am
TL;DR: Standing privilege in Azure leaves users, service principals, managed identities, automation, vendors, and AI agents with access that outlives the work, expanding blast radius even when authentication is strong, according to Sonrai Security. The real control problem is permissions, not sign-in, and JIT only works when it covers every identity type and right-sizes roles first.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Just-in-Time Access for Azure Without New Infrastructure”.
Key questions
Q: What breaks when Azure JIT only covers human admins?
A: A JIT programme that stops at human administrators leaves service principals, managed identities, automation, vendors, and AI agents with standing permission.
Q: Why does standing privilege increase the impact of compromised cloud credentials?
A: Standing privilege leaves access available even when it is not actively needed, which gives attackers a larger window to reuse stolen credentials.
Q: How do security teams know whether JIT is actually reducing risk?
A: Measure the privilege width of each grant, the frequency of repeated elevations, and how often sessions remain active after the task is complete.
Practitioner guidance
- Right-size roles before enabling JIT Review whether the baseline Azure role is already broader than the actual task.
- Bring non-human identities into access reviews Inventory service principals, managed identities, automation accounts, vendor accounts, and AI agents alongside human users.
- Use approval context to record why access exists Require a reason for activation and keep the approval trail attached to the specific task.
Bottom line: Azure JIT is useful only when it shrinks standing privilege across the full identity estate, not just among named administrators.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:49 am
Standing privilege is the Azure governance failure, not sign-in weakness: the article is right to separate authentication from authorisation. Azure environments often keep permissions alive long after the task that justified them has ended, which means the real control gap is lifecycle drift in entitlements. The practitioner takeaway is to treat unused privilege as residual attack surface, regardless of whether the identity is human or non-human.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between Entra PIM and network-based JIT VM access?
A: Entra PIM governs privileged role activation at the IAM layer, so it controls whether an identity has a privileged permission and for how long. Network-based JIT VM access only opens management ports temporarily. One limits authorisation, the other limits connectivity, and both are needed when Azure privilege and access paths must be controlled separately.
👉 Read our full editorial: Just-in-time access for Azure exposes the standing privilege gap