pim-review

You can review Azure PIM role assignments by running a scan that parses optional role or user input, invokes appropriate MCP tools, and returns a structured risk report highlighting standing admin roles and over-privileged access with recommendations.

Over-privileged access in Azure AD occurs when role assignments are broader than required. A PIM review identifies these governance gaps by flagging risky patterns and suggesting corrections to reduce security exposure.

Yes, checking for expired M365 tenant role assignments is supported. The review applies to both Azure and M365 tenant governance workflows, catching assignments that are no longer valid and surfacing them in a structured report.

Yes, the PIM risk review works without specific arguments. When a role name or user UPN is omitted, it automatically reviews a broader set of Privileged Identity Management role assignments across the tenant.

The best way to identify lingering privileged access is running a PIM review that flags standing admin roles and expired assignments, validating results against tenant governance workflows to surface misconfiguration risks.

You should not rely solely on automated PIM role assignment scanning when complex governance gaps require manual context, as the review identifies over-privileged access patterns but owners must manually correct broader-than-required access.