Topic starter
25/06/2026 1:25 am
TL;DR: Standing privilege leaves Azure access alive after the work ends, Sonrai Security reports, so blast radius stays large even when authentication is strong. Azure governance has to cover users, service principals, managed identities, automation, vendors, and AI agents if JIT is to reduce exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Sonrai Security: “Just-in-Time Access for Azure Without New Infrastructure”.
Key questions
Q: Why does standing privilege increase the impact of compromised cloud credentials?
A: Standing privilege leaves access available even when it is not actively needed, which gives attackers a larger window to reuse stolen credentials.
Q: How do security teams know whether JIT is actually reducing risk?
A: Measure the privilege width of each grant, the frequency of repeated elevations, and how often sessions remain active after the task is complete.
Q: What breaks when Azure JIT only covers human admins?
A: A JIT programme that stops at human administrators leaves service principals, managed identities, automation, vendors, and AI agents with standing permission.
Practitioner guidance
- Right-size roles before enabling JIT Review whether the baseline Azure role is already broader than the actual task.
- Bring non-human identities into access reviews Inventory service principals, managed identities, automation accounts, vendor accounts, and AI agents alongside human users.
- Use approval context to record why access exists Require a reason for activation and keep the approval trail attached to the specific task.
Bottom line: Azure JIT is useful only when it shrinks standing privilege across the full identity estate, not just among named administrators.
Glossary terms: Standing Privilege, Just-in-Time Access Request, Eligible Role, Permissions-first PAM
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:49 am
Standing privilege is the Azure governance failure, not sign-in weakness: the article is right to separate authentication from authorisation. Azure environments often keep permissions alive long after the task that justified them has ended, which means the real control gap is lifecycle drift in entitlements. The practitioner takeaway is to treat unused privilege as residual attack surface, regardless of whether the identity is human or non-human.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between Entra PIM and network-based JIT VM access?
A: Entra PIM governs privileged role activation at the IAM layer, so it controls whether an identity has a privileged permission and for how long. Network-based JIT VM access only opens management ports temporarily. One limits authorisation, the other limits connectivity, and both are needed when Azure privilege and access paths must be controlled separately.
👉 Read our full editorial: Azure just-in-time access must cover nonhuman identities too
This post was modified 1 day ago by NHI Mgmt Group