Privileged access review Early access

See who holds the keys to your tenants, and which ones can go.

TenantFlex reads every privileged role assignment across Azure, Entra ID and Okta, gives each one a verdict, and scores the tenant's posture. You get a change bundle to run yourselves. The review never writes to the tenant.

Ask for early access

Microsoft Entra IDOktaPingOneadditional IdPs on request

Read only · apply.sh · rollback.sh · adopt.tf

What the review does

Every privileged role, one verdict each, one score.

Every privileged role, in one reviewAzure RBAC at management group, subscription and resource group scope. Entra ID directory roles, active and PIM-eligible. Okta admin roles, standard and custom, held directly or through a group.
A verdict for each assignmentEvery removal is proved from the tenant's own structure: an assignment already inherited from a parent scope, covered by a broader role the same principal holds, or held by a principal that no longer exists. Anything that cannot be proved is kept and flagged for review.
A posture score you can compare0 to 100, with every deduction named: standing privilege, too many tenant admins, privileged guests, unused custom roles, no recent sign-in. Each scan shows what changed since the last one.
Checked against Microsoft and Okta guidanceGlobal Administrator and Super Administrator counts, guest and on-premises-synced admins, standing privilege outside PIM, and phishing-resistant MFA for admin accounts.
You make the changeThe bundle holds apply and rollback scripts with a dry run and a tenant guard, refuses to remove a scope's last owner, and adds Terraform import blocks for the assignments you keep.

What it reads

Entra ID: RoleManagement.Read.DirectoryRoleAssignmentSchedule.Read.Directory
Azure: A read-only role at the root management group
Okta: okta.roles.readokta.users.readokta.groups.read

Nothing that can write.

What's next. Application consent and OAuth grant review follows, so what was approved in the source is understood in the target.

Get started

Ask for early access.

Tell us which of Azure, Entra ID and Okta you run and roughly how many admins you expect. We will run the first review with you.

[email protected] · www.tenantflex.com