Permissions of inactive identities in your Azure subscription should be revoked

What does the recommendation "Permissions of inactive identities in your Azure subscription should be revoked" check?

Flags any identity, a user, group, service principal or managed identity, that holds a role assignment in the subscription but has not performed a single action on any resource for 45 days. It analyses the activity behind each assignment, not just whether the role exists, so a wholly dormant account with Contributor still flags even though the assignment is technically valid. This is a Cloud Infrastructure Entitlement Management finding, so it needs the Defender CSPM plan with Permissions Management enabled. It does not measure how much of an active identity's permission is unused, that is the separate over-provisioned identities recommendation, and it does not act on Entra ID sign-in state, so a recently disabled account that was busy last week will not appear here yet.

Why does "Permissions of inactive identities in your Azure subscription should be revoked" matter?

Inactive identities are standing access nobody is watching. A service principal left over from a decommissioned pipeline, or a leaver whose RBAC was never cleaned up, keeps full rights to the subscription with credentials that are rarely rotated and usually outside MFA. If those credentials leak or are guessed, an attacker inherits real, often privileged, access and no one notices because the legitimate owner never logs in to spot the anomaly. Revoking dormant permissions shrinks the attack surface to the identities actually doing work, which is also what an auditor expects to see under a periodic access-review obligation. The business cost is concrete: every dormant privileged assignment is a path to data exfiltration or resource hijacking that you are paying to defend but getting no value from, and clearing them is one of the cheapest ways to reduce blast radius.

How do I fix "Permissions of inactive identities in your Azure subscription should be revoked"?

1. Confirm the identity is genuinely dormant: in the recommendation's details pane in Defender for Cloud, review the listed identity and its last activity date before removing anything, so you do not break a low-frequency but legitimate workload.
2. Remove the unneeded role assignment with 'az role assignment delete --assignee <objectId-or-appId> --role <roleName> --scope /subscriptions/<subscriptionId>', or for a person who has left, disable the account in Entra ID so every assignment lapses at once.
3. Stop dormancy recurring: put privileged roles behind Entra Privileged Identity Management so access is time-bound and just-in-time, and schedule a recurring Entra ID Governance access review over the subscription so unused assignments are surfaced and revoked on a cadence rather than discovered by Defender after the fact.

# 1. Revoke a stale or inactive privileged assignment (zero Azure cost).
# A leftover service principal cannot use just-in-time access, so it loses the role outright.
SUB="00000000-0000-0000-0000-000000000000"
az role assignment delete \
  --assignee "<service-principal-object-id>" \
  --role "Owner" \
  --scope "/subscriptions/$SUB"

# 2. Convert a human administrator's PERMANENT Owner to a PIM ELIGIBLE assignment.
#    Eligible assignments are made via the ARM authorization API (no 'az role assignment'
#    flag exists for this). 'az rest' calls it directly, so this block runs as-is.
PRINCIPAL="<user-object-id>"
# Owner role definition ID is the same well-known ID in every tenant:
ROLE_DEF="/subscriptions/$SUB/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
REQ_NAME=$(cat /proc/sys/kernel/random/uuid)

az rest --method put \
  --url "https://management.azure.com/subscriptions/$SUB/providers/Microsoft.Authorization/roleEligibilityScheduleRequests/$REQ_NAME?api-version=2020-10-01" \
  --body "{\"properties\":{\"principalId\":\"$PRINCIPAL\",\"roleDefinitionId\":\"$ROLE_DEF\",\"requestType\":\"AdminAssign\",\"scheduleInfo\":{\"startDateTime\":null,\"expiration\":{\"type\":\"NoExpiration\"}},\"justification\":\"Replace standing Owner with just-in-time eligibility (MCSB PA-2)\"}}"

# 3. Only AFTER eligibility is confirmed, remove the old PERMANENT (active) assignment
#    so the administrator is never locked out:
az role assignment delete \
  --assignee "$PRINCIPAL" \
  --role "Owner" \
  --scope "/subscriptions/$SUB"