Administrative Account Migration Assessment and Access Review

Fahad Noaman 171 Reputation points
2026-09-07T14:14:23.6233333+00:00

We are planning a phased migration of privileged administrative accounts from legacy administrative accounts on prem to cloud-only Microsoft Entra administrative accounts .

Before migrating each account, we need a comprehensive assessment of all access currently assigned to the existing administrative account.

Could you please provide Microsoft best practices, recommendations, and available tools/reports to identify:

  1. Microsoft Entra ID directory roles assigned directly or through groups.
  2. Azure RBAC role assignments across Management Groups, Subscriptions, Resource Groups, and Resources.
  3. Privileged Identity Management (PIM) eligible and active role assignments.
  4. Enterprise Application ownership and delegated permissions.
  5. App Registration ownership and API permissions.
  6. Microsoft 365 administrative roles.
  7. Group memberships, including privileged groups.
  8. Conditional Access policy exclusions and assignments.
  9. Azure Key Vault access policies and RBAC assignments.
  10. Ownership of Automation Accounts, Logic Apps, Functions, Runbooks, and Service Principals.
  11. Exchange Online administrative permissions.
  12. SharePoint Online and Teams administrative permissions.
  13. Devops , Power app etc.

We are looking for a repeatable migration assessment checklist and preferably Microsoft-supported reports, Graph API queries, PowerShell modules, or Governance features that can automate this review process.

Additionally, please advise how organizations typically validate that no critical access is missed prior to disabling the legacy privileged account.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Abdul Waqas 0 Reputation points
    2026-09-08T17:52:12.3066667+00:00

    Hi,

    I recommend reviewing the old account’s access before deleting it. The following checks should cover the main areas:

    Entra roles – Check direct role assignments and any role-assignable group memberships. Confirm the results with Get-MgUserMemberOf.

    Azure RBAC – Use Azure Resource Graph to identify all RBAC assignments across management groups, subscriptions, resource groups, and resources. Manually verify a few results in Access Control (IAM).

    PIM roles – Check both Eligible and Active assignments under Privileged Identity Management.

    Applications and automation – Check Enterprise Applications, App Registrations, Automation Accounts, Logic Apps, and Service Principals owned by or linked to the account. Also search automation/runbook code for references to the account.

    Group memberships – List all group memberships and identify any groups providing privileged access.

    Conditional Access – Check whether the account is excluded from any Conditional Access policies. Use the What If tool to confirm which policies apply.

    Service-specific access – Review access in Key Vault, Exchange, SharePoint, Teams, Azure DevOps, and Power Platform, as these may have permissions outside standard Azure RBAC.

    Containment before deletion – Once the access review is documented, disable sign-in rather than deleting the account immediately. Monitor sign-in logs and automation/pipeline activity for 2–4 weeks. If there are no issues, proceed with deletion through the normal change process.

    This approach should help identify any hidden dependencies or privileged access before the account is permanently removed.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.