Description:Entra and Azure admins inherit broad roles, audit pressure, and little proof of what access people actually need. This 400-level session uses Azure RBAC and Entra activity logs as evidence of what admins, apps, and service principals actually did. A custom PowerShell role-mining tool normalizes and clusters those actions into proposed least-privilege custom roles and a review packet showing current access, used actions, rare actions, and how to structure a pilot.
What you will learn:- Build a role-mining pipeline from Azure RBAC and Entra activity logs.
- Use actual admin, app, and service-principal activity to derive data-driven custom roles and show which permissions can be safely removed.
- Test proposed custom roles before rollout: confirm normal work still succeeds, risky actions stay blocked, and admins have a temporary fallback through Entra PIM.
- Understand how role mining can also be used as part of access reviews and attestation processes.
