Notifications
Clear all
Topic starter
25/08/2026 6:11 pm
TL;DR: Azure access outcomes are determined less by the platform itself than by how teams issue, scope, and review power across subscriptions, resource groups, and data planes, according to Veza. The practical shift is toward eliminating standing privilege, tightening role scope, and governing non-human identities as power users because current controls still allow broad blast radius and audit friction.
NHIMG editorial — based on content published by Veza: an Azure access governance guide focused on RBAC, PIM, and non-human identities
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams reduce Azure blast radius without slowing delivery?
A: Start by converting standing admin to eligible access, then push grants to the smallest workable scope and review non-human identities as first-class identities.
Q: Why do non-human identities increase Azure risk so quickly?
A: Because they often hold durable rights, are granted broadly for convenience, and do not naturally expire when a project changes.
Q: What breaks when Azure access reviews do not include service principals?
A: The review may certify human access while leaving the highest-risk automation untouched.
Practitioner guidance
- Eliminate always-on high-impact roles Convert Owner, Contributor, User Access Administrator, and similar roles to eligible assignments with approval, MFA, and a short activation window.
- Shrink scope at the point of assignment Assign roles at the smallest scope that still supports the work, then justify any subscription or management-group grant in one sentence.
- Register every NHI as a governed identity Record an owner, purpose, expiry date, and rotation cadence for each service principal or managed identity.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- Portal and CLI walk-throughs for finding active Owner, Contributor, and User Access Administrator assignments.
- Subscription and resource-group filtering steps for identifying risky custom roles and wildcard service principals.
- Examples of evidence to retain for audits, including eligible versus active counts and break-glass test results.
- Fast checks for guest expiry and entitlement management that help teams clean up external access.
👉 Read Veza's guide to Azure access governance, PIM, and NHI scope control →
Azure RBAC, PIM, and NHI scope control: what teams miss?
Explore further
25/08/2026 6:11 pm
Azure access governance is really blast-radius governance. The article is correct to place standing privilege, scope, and NHI treatment at the centre of the control model. In cloud estates, the decisive question is not whether access exists, but how much damage a single identity can do before review or revocation. Practitioners should treat every access decision as a blast-radius decision.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows why workload identity oversight remains incomplete.
A question worth separating out:
Q: Who is accountable when over-privileged Azure identities create a breach path?
A: Accountability sits with the programme that owns identity governance, cloud configuration, and lifecycle control, not with the cloud provider alone. Azure secures the platform layer, but organisations decide who can do what inside it. That means IAM, cloud security, and control owners all share responsibility for effective permissions, revocation, and evidence.
👉 Read our full editorial: Azure access governance depends on shrinking blast radius
