Common Workflows
Step-by-step guides for implementing Access Optimization in real-world scenarios. Each workflow includes detailed steps, expected results, and practical tips for successful execution.
Five Essential Workflows
- Quarterly Security Audit: Identify and remediate over-privileged access before compliance deadlines
- User Offboarding: Verify complete access removal including group memberships
- Least-Privilege Enforcement: Downgrade critical roles based on actual usage patterns
- Group Membership Cleanup: Remove inactive users from Azure AD groups
- Subscription Migration: Clean up lingering access after workload migrations
Workflow 1: Quarterly Security Audit
Scenario
Your organization requires quarterly reviews of Azure RBAC assignments to ensure least-privilege compliance. You need to identify and remediate over-privileged access before the quarterly audit submission deadline.
Implementation Steps
1. Configure Analysis Window
- Navigate to Access Control → Access Optimization in the StratoLens sidebar
- Set the Time Window to 90 days (current quarter)
- Leave detection thresholds at defaults (50% stale, 30% over-scoped, 5 sprawl) or adjust based on your organization's policies
2. Review Principal List
- Principal list defaults to sorting by Most Optimizations (highest counts first)
- Start with principals showing high optimization counts
- Red badges indicate critical over-privileged findings
3. Investigate Each Finding
- Click each principal to view the detail panel with specific optimization findings
- Review the Explanation field to understand why it was flagged
- Check the Evidence section (Last Used date, Activity Count, Operation breakdown)
- Click View in Activity Explorer to investigate detailed activity patterns
- Click View in Role Assignments to see all assignments for this principal
4. Document Remediation Decisions
Remove
Access clearly unused or redundant → schedule for removal
Downgrade
Over-privileged → plan role downgrade (e.g., Owner → Contributor)
Rescope
Over-scoped → plan scope reduction (e.g., subscription → resource group)
Justify
Access is appropriate → document business justification for audit trail
5. Export and Coordinate
- Use the Export button (top-right, if available) to download findings as CSV or JSON for audit documentation
- Coordinate with resource owners and managers to approve remediation plans
6. Execute Remediation
- Execute remediations in Azure Portal (remove assignments, downgrade roles, rescope permissions)
- After remediation, trigger a new StratoLens scan or wait for next scheduled scan (default every 5 minutes)
- Return to Access Optimization to verify optimization findings have disappeared for remediated principals
Expected Results
- CSV/JSON export containing all optimization findings with evidence
- Documented remediation decisions for each finding (remove/downgrade/rescope/justify)
- Reduced optimization count in subsequent scans after remediation
- Audit-ready documentation showing due diligence in maintaining least-privilege access
Prioritization Tips
- Prioritize optimizations by severity: Over-Privileged (red) > Unused (green) > Stale (blue) > Over-Scoped (amber)
- Use Activity Explorer's operation type filtering to understand exactly what operations users perform
- Filter by Role Type: Critical to focus on Owner and User Access Administrator assignments first
- Document justifications for retained access in your organization's CMDB or ticketing system
- Schedule quarterly reviews in calendar to align with StratoLens scanning and audit cycles
Workflow 2: User Offboarding Verification
Scenario
An employee has left the organization. You need to verify complete access removal, including both direct RBAC assignments and access granted via Azure AD group memberships, to ensure no lingering permissions remain.
Implementation Steps
1. Gather User Information
- Obtain the departing user's User Principal Name (UPN, email address) or Azure AD Object ID from your HR system or identity team
2. Configure Analysis
- Navigate to Access Control → Access Optimization
- Set Time Window to 90 days to detect recent inactivity (user likely hasn't accessed resources since leaving)
3. Locate User
- In the principal list, scroll or search for the specific user by name
- If the user doesn't appear: No optimization findings were detected, but verify in Role Assignments to see all assignments regardless of usage
4. Identify Group-Based Access
- Click the user's row to open the detail panel
- Review each optimization finding, noting:
- Direct assignments (no "Via Group" field)
- Group-based assignments (shows "Via Group: [Name]" with nested chain if applicable)
- Pay close attention to assignments showing "via [Group Name]" subtitle
5. Document Group Memberships
- For each group-based assignment, note the group name (e.g., "Engineering Team", "All Employees")
- Check for nested group chains (e.g., "Engineering Team → All Employees")
- Document which groups require user removal
6. Execute Cleanup
- Navigate to Access Control → Role Assignments to verify the complete list of direct assignments
- Create tickets or coordinate with Azure AD administrators to:
- Remove user from identified Azure AD groups
- Remove any remaining direct RBAC assignments in Azure Portal
- Verify Azure AD account deactivation/deletion with identity team
7. Verify Completion
- Wait for next StratoLens scan (5 minutes default) or trigger manual scan
- Return to Access Optimization and search for the user again
- Success verification: User should not appear in principal list (no assignments remaining)
Expected Results
- User has zero remaining role assignments (direct or via groups)
- User does not appear in Access Optimization principal list after re-scan
- Documentation of all groups user was removed from for audit trail
- Confirmation that offboarding checklist access removal step is complete
Offboarding Best Practices
- Set time window to 90 days to ensure you capture recent activity (user may have accessed resources in their final weeks)
- Pay special attention to nested group memberships (often overlooked in offboarding)
- Check for service principal assignments if the user had any automated processes or applications under their account
- Document group memberships before removal for potential rehire scenarios or audit questions
- Cross-reference with Role Assignments feature to ensure completeness (Access Optimization only shows principals with optimization findings)
- Consider filtering by Principal Type: User to focus on user accounts only
Workflow 3: Least-Privilege Enforcement for Critical Roles
Scenario
Your security policy requires that Owner and User Access Administrator roles only be granted when actively used for RBAC management. You need to identify and downgrade users with critical roles who don't actually manage permissions.
Implementation Steps
1. Configure Critical Role Analysis
- Navigate to Access Control → Access Optimization
- Set Time Window to 365 days for maximum historical analysis (catch infrequent but legitimate RBAC usage)
- Apply filters:
- Role Type: Select Critical only (focuses on Owner and User Access Administrator)
- Optimization Type: Select Over-Privileged (shows principals with critical roles but no RBAC operations)
2. Prioritize Findings
- Review the filtered principal list showing only users, groups, and service principals with critical roles but no RBAC activity
- Sort by Most Optimizations to prioritize principals with multiple over-privileged assignments
3. Analyze Operation Patterns
- For each principal, click to open detail panel
- Review the Role badge (Owner or User Access Administrator)
- Check the Operations breakdown to see what operations they do perform:
- High Create/Update counts → Likely need Contributor (resource management)
- High Read/Action counts → Likely need custom role or specific resource-level permissions
- Zero RBAC operations → Confirms over-privileged status
- Click View in Activity Explorer to see detailed operation history
4. Determine Appropriate Role
Contributor
Creates/manages VMs, storage, networking
Reader
Only reads metrics and logs
Custom Role
Specific actions on specific resources
5. Get Approvals
- For each downgrade decision:
- Export findings or take screenshots for approval documentation
- Coordinate with principal's manager to confirm appropriate role level
- Verify no legitimate RBAC management responsibilities (emergency access, disaster recovery, delegation)
6. Execute Downgrades
- After approvals, execute downgrades in Azure Portal:
- Remove Owner or User Access Administrator assignment
- Grant replacement role (Contributor, Reader, custom role)
- Notify affected principals of role change before execution to avoid disruption
- Trigger new StratoLens scan after remediation
- Verify over-privileged findings are resolved for downgraded principals
Expected Results
- All Owner and User Access Administrator roles are actively used for RBAC operations
- Principals not performing RBAC management are downgraded to appropriate roles (Contributor, Reader, custom)
- Documented evidence and approvals for each role change
- Reduced attack surface and improved compliance with least-privilege principles
Critical Role Best Practices
- Use Activity Explorer's Operation Type: RBAC filter to specifically look for permission management activity
- Consider creating custom roles for common permission patterns (e.g., "VM Operator" with start/stop/restart but no create/delete)
- Notify users before downgrade to prevent surprise when they lose access
- Document emergency access procedures for critical roles (break-glass accounts, PIM activation)
- Some organizations use Privileged Identity Management (PIM) for just-in-time critical role activation - consider this for legitimate occasional needs
- Filter by Principal Type: Service Principal separately to review application identities with critical roles
Workflow 4: Group Membership Cleanup
Scenario
Your organization grants access via Azure AD groups, but group memberships accumulate over time as team members change roles or leave. You need to identify users who should be removed from groups based on inactivity.
Implementation Steps
1. Configure Group Analysis
- Navigate to Access Control → Access Optimization
- Set Time Window to 180 days (6 months) to catch seasonal access patterns
- Set thresholds to match your organization's policies:
- Stale Threshold: 60% (flag access inactive for more than 108 days in 180-day window)
- Leave over-scoped and sprawl thresholds at defaults
2. Identify Group-Based Access
- Look for principals showing group-based access in the principal list:
- Users with "via [Group Name]" subtitle below their name
- Users showing Users icon (👥) next to subtitle text
- Filter by Optimization Type to focus on specific issues:
- Unused: Group members with zero activity
- Stale: Group members with infrequent activity
- Over-Scoped: Group members using only small portion of group's access scope
3. Review Evidence
- Click each principal to view detailed optimization findings
- For each optimization finding with "Via Group" field:
- Note the group name (e.g., "DevOps Engineers", "Contractor-Readonly")
- Check for nested group chains (e.g., "Engineering Team → All Employees")
- Review evidence:
- Last Used: When they last accessed resources via this group's permissions
- Activity Count: How many operations they performed
- Scope Efficiency: What percentage of the group's access scope they actually use
4. Identify Patterns
Multiple Users, Same Group
Entire group may be over-assigned
Single User Unused
Individual should be removed from group
Nested Chain, No Activity
Review group structure for unnecessary nesting
5. Determine Root Cause
- For each group with inactive members:
- Document members with unused/stale access via that group
- Click View Group in Role Assignments button (if shown) to see group's complete access
- Determine root cause:
- User changed roles → Remove from group
- User on extended leave → Document exception or remove temporarily
- Group grants excessive access → Consider creating more granular groups
6. Execute Cleanup
- Coordinate with group owners (check Azure AD group ownership):
- Provide list of users to remove from group
- Explain evidence (no activity for 180 days, only used 5% of group's scope, etc.)
- Get approval for removals
- Execute group membership cleanup in Azure AD:
- Remove inactive users from groups
- Consider restructuring overly broad groups into role-specific groups
- Wait for next scan (5 minutes) or trigger manual scan
- Verify optimization findings for group-based access are reduced
Expected Results
- Azure AD groups contain only active members who actually use the group's permissions
- Reduced unused/stale access granted via group memberships
- Documentation of which users were removed from which groups for audit trail
- Cleaner group structure aligned with current team composition
Group Cleanup Best Practices
- Focus on groups granting broad access (Contributor, Owner roles) or access to production subscriptions first
- Review nested group chains carefully - removing users from parent groups may be more appropriate than removing from child groups
- Use Activity Explorer to verify user activity before removal (some users may have legitimate intermittent access needs)
- Consider setting up Azure AD access reviews for automated periodic group membership validation
- Document business justifications for users who remain in groups despite low activity (seasonal workers, on-call engineers, disaster recovery roles)
- Filter by Principal Type: User to focus on human identities (exclude service principals and managed identities)
Workflow 5: Subscription Migration Cleanup
Scenario
Your organization recently migrated workloads from Subscription A to Subscription B. You need to identify and remove lingering access to the old subscription now that resources have been moved.
Implementation Steps
1. Identify Subscriptions
- Source subscription (old)
- "Production-Legacy" (Subscription A)
- Target subscription (new)
- "Production-Current" (Subscription B)
- Migration completion date
- For time window selection
2. Configure Time Window
- Navigate to Access Control → Access Optimization
- Set Time Window to cover the post-migration period:
- If migration completed 2 weeks ago → 30 days (includes pre and post migration)
- If migration completed 2 months ago → 90 days (comprehensive view)
3. Identify Migration Patterns
- In the principal list, look for patterns:
- Principals with high optimization counts may have access on both old and new subscriptions
- Unused access findings likely target the old subscription if migration was successful
- Click each principal to view detail panel optimization findings
- For each optimization, review the Subscription field (shown for resource groups and resources)
4. Check for Specific Patterns
Unused on Subscription A
Likely safe to remove (workloads migrated to B)
Stale on Subscription A
Last activity before migration date = expected
Active on Both A and B
User may need access to both during transition
5. Determine Cleanup Actions
- For each principal with access to Subscription A:
- Verify their role on Subscription A (check detail panel)
- Check if they also have assignments on Subscription B:
- Navigate to Role Assignments
- Filter by principal
- Compare role assignments across subscriptions
- Determine cleanup action:
- Same role on both subs → Remove Subscription A assignment (migration complete)
- Different roles on subs → Verify which is correct for new environment
- Only Subscription A → May indicate user no longer needs access (workload owner changed)
6. Coordinate and Execute
- Export findings or document principals with Subscription A access to remove:
- List principal name, role, scope, last activity date
- Note any exceptions (e.g., decommissioning team needs temporary Subscription A access)
- Coordinate with subscription owner and workload teams:
- Confirm migration is complete and Subscription A is ready for decommissioning
- Verify no ongoing dependencies on Subscription A resources
- Get approval to remove access
- Execute access removal in Azure Portal:
- Remove role assignments on Subscription A for migrated users
- Keep a small number of Owners on Subscription A for decommissioning work
- Document exceptions (e.g., 2-3 administrators with Owner for final cleanup)
- Set a timeline for complete Subscription A decommissioning and final access removal
7. Verify Cleanup
- Trigger new scan after access removal
- Verify optimization findings for Subscription A are reduced or eliminated
Expected Results
- Subscription A (old) has minimal role assignments (only for decommissioning work)
- Most user access has migrated to Subscription B (new)
- Documentation of cleanup actions and timeline for final decommissioning
- Verification that migration is complete from access perspective
Migration Cleanup Best Practices
- Coordinate closely with workload owners before removing access - some migrations have extended parallel run periods
- Keep 2-3 emergency administrators with Owner on old subscription for rollback scenarios during transition
- Use the Last Used date in detail panel to identify when users last accessed Subscription A (should be before migration date)
- Set a firm decommissioning date for Subscription A and communicate to all stakeholders
- Consider filtering by Role Type: Critical first to ensure Owner/UAA roles are cleaned up appropriately
- Use Activity Explorer to verify no recent activity on Subscription A (confirms migration success)
- Document the final state of Subscription A access for audit trail before final decommissioning