Skip to main content

Azure Governance: Policy and RBAC Review

Overview​

Governance is a read-only review of how an Azure tenant is governed. It brings management groups, subscriptions, Azure Policy, RBAC, privileged and custom roles, exemptions, Global Administrator posture, findings, and their relationships into one page.

For the company compliance scoreboard, Defender and Policy control evidence, SDM report movement, recommended standards and scoped Azure Policy exemptions, see Azure Regulatory Compliance.

What Governance checks​

Each scan, Spotto reads three Azure sources and raises findings for each subscription. Global Administrator posture is shown on its own tab.

Governance reads three sources: 1 Azure Resource Manager (management groups, policy assignments, definitions and exemptions, role assignments and definitions); 2 Azure Resource Graph (Azure Policy results: non-compliant resources and exemptions expiring within 90 days); 3 Microsoft Graph (service principals, directory roles, PIM assignments, activations and MFA registration). Checks that raise a finding per subscription: Policy: expired exemptions (high, source 1); exemptions with an expiry date still to come (medium, sources 1 and 2); assignments whose definition is missing (medium, 1); non-compliant resources (medium, or high at 100 or more, 2). RBAC: Owner, User Access Administrator or Privileged Role Administrator assignments (high, 1); custom roles that can write role assignments (high, 1); assignments at subscription or root scope (medium, 1). Identity: service principals or managed identities holding those privileged roles (high, 1 and 3). Hierarchy: no management group path for the subscription (low, or info when hierarchy data is incomplete; 1). Coverage: evidence for an area is unavailable (medium) or only partial (low), any source. The Global Admins tab shows, tenant-wide from Microsoft Graph, each Global Administrator's assignment (direct or through a group), PIM status (PIM-backed, permanent, not enabled or unknown), mode (eligible, active or permanent, with last activation) and MFA (capable or unknown), with unresolved principals counted separately. These do not raise findings.Governance reads three sources: 1 Azure Resource Manager (management groups, policy assignments, definitions and exemptions, role assignments and definitions); 2 Azure Resource Graph (Azure Policy results: non-compliant resources and exemptions expiring within 90 days); 3 Microsoft Graph (service principals, directory roles, PIM assignments, activations and MFA registration). Checks that raise a finding per subscription: Policy: expired exemptions (high, source 1); exemptions with an expiry date still to come (medium, sources 1 and 2); assignments whose definition is missing (medium, 1); non-compliant resources (medium, or high at 100 or more, 2). RBAC: Owner, User Access Administrator or Privileged Role Administrator assignments (high, 1); custom roles that can write role assignments (high, 1); assignments at subscription or root scope (medium, 1). Identity: service principals or managed identities holding those privileged roles (high, 1 and 3). Hierarchy: no management group path for the subscription (low, or info when hierarchy data is incomplete; 1). Coverage: evidence for an area is unavailable (medium) or only partial (low), any source. The Global Admins tab shows, tenant-wide from Microsoft Graph, each Global Administrator's assignment (direct or through a group), PIM status (PIM-backed, permanent, not enabled or unknown), mode (eligible, active or permanent, with last activation) and MFA (capable or unknown), with unresolved principals counted separately. These do not raise findings.

Why use this? (Jobs, pains, gains)​

Jobs to be done​

  • When I review Azure governance posture, I want to see management groups, subscriptions, policy, RBAC, findings, and coverage together, so I can understand the implementation without stitching it together manually.
  • When a subscription has risk, I want to drill into policy, exemptions, RBAC, privileged roles, and custom roles, so I can separate expected governance from drift or over-permissioned access.
  • When a compliance or access question comes up, I want to trace scope and inheritance, so I can explain why a policy or role applies where it does.
  • When governance relationships are unclear, I want a graph of policies, assignments, roles, principals, and hierarchy, so I can follow the chain instead of reading raw IDs.

Common pains​

  • Azure governance data is spread across Management Groups, Policy, IAM, Entra ID, subscriptions, and Resource Graph.
  • Inheritance makes simple questions difficult: an assignment at a management group can explain behavior far below it.
  • Empty tables can be misleading unless you know whether data coverage is complete, partial, unavailable, skipped, or unknown.
  • Policy exemptions and custom roles are easy to miss, even though they often explain why governance differs from the expected baseline.
  • Privileged RBAC assignments can hide in normal access lists unless they are surfaced as review items.

Turn the evidence into a decision​

Select the labelled briefcase Business Value button beside Notes. The brief combines live findings, high/critical severity, policy or privileged-access metrics, and evidence coverage with a decision narrative.

The displayed facts remain live and missing evidence is called out. Generate tailors only the narrative for permitted users, saves it for the exact scope, and shows a freshness warning when evidence changes. Clear removes that saved narrative and immediately restores the standard Business Value content without deleting Customer Context or changing live facts. Above 100 subscriptions, the curated live brief remains available without tailoring.

Current position and priority work​

Address critical and high-impact policy, privileged-access, and ownership gaps first. Restore incomplete evidence sources before treating the posture as complete, then define the standard control baseline and time-bound exception process.

Business outcomes​

Governance turns cloud standards into repeatable delivery guardrails. Strong hierarchy, policy, and access ownership can make secure, compliant delivery easier rather than relying on manual review for every workload.

Cost of delay​

Control drift can increase security exposure, audit effort, and the cost of correcting inconsistent environments. Broad privilege or unclear ownership can also make incidents harder to prevent, investigate, and contain.

Decision required​

Approve the minimum control baseline, remediation owners, exception authority, and next compliance review date.

Validate with stakeholders​

When you can manage Company Notes, select any question in the portal to retain the answer in the relevant Customer Context note.

  • Which standards must apply everywhere, and where are exemptions legitimate?
  • Who owns policy, privileged access, exceptions, and remediation at each scope?
  • Which audits or platform changes make governance work time-sensitive?

Key capabilities​

Review tenant governance posture​

The Overview tab starts with tenant-level metrics for the selected cloud account: subscriptions, management groups, findings, high and critical findings, non-compliant resources, privileged assignments, policy assignments, and RBAC assignments. Breakdown cards show findings by severity, category, and subscription, so you can see whether risk is isolated or spread across the environment.

Check governance data coverage​

The coverage panel shows whether each collection area is complete, partial, unavailable, skipped, or unknown. No RBAC rows with complete coverage means something different from no RBAC rows because RBAC collection is unavailable. The labels are text, not just color, so they stay readable in exports, screenshots, and assistive technology.

Review Global Administrator posture​

Open Global Admins for tenant-level Global Administrator access. Summary cards count total principals, PIM-backed access, permanent assignments, and unresolved principals.

Review the collection coverage notice before treating an empty or incomplete result as clean. Missing Microsoft Graph role, eligibility, audit, user, group, or membership evidence limits the assessment.

Drill into subscriptions​

Use Subscription Drill-Through or View Details in the subscription table to inspect one subscription:

  • Findings by severity, category, and scope.
  • Policy assignments, effects, compliance state, and scope.
  • Policy exemptions, category, expiry, and scope.
  • RBAC assignments, role, principal, scope, and inheritance.
  • Privileged role assignments.
  • Custom roles and assignable scopes.
  • The management group path for the subscription.

Use it when an incident, failed deployment, sensitive action, or access review needs subscription-level evidence. Select Add to Kanban Board on a row to track it as work; see Tracked Recommendations.

Inspect policy and RBAC relationships​

The Graph tab shows relationships for the selected tenant or subscription: containment, assignment scope, definition references, policy set membership, role grants, and principal links. Nodes can be tenants, management groups, subscriptions, policy assignments, definitions and set definitions, exemptions, role assignments, role definitions, and principals.

Use search and the node-type filter to isolate a policy, role, principal, or subscription. Selecting a node opens its details; on a subscription node, Open Subscription Detail jumps back to the subscription review.

Investigate findings that need attention​

Findings, high and critical findings, non-compliant resources, and privileged assignments are treated as attention metrics when their count is above zero. Start with high findings, then check whether they are tied to a specific subscription, management group path, policy assignment, or privileged role.

Where to find it​

In the Spotto Portal, go to Security -> Posture -> Governance.

Governance keeps the selected cloud account, subscription drill-through, and active view while you stay on the page. Leaving the page clears those query parameters so other pages do not inherit a stale scope.

  1. Select the company and Azure cloud account you want to review.
  2. Check the tenant metrics for findings, high and critical findings, non-compliant resources, and privileged assignments.
  3. Review coverage before trusting an empty table.
  4. Open Tenant Governance Data and scan the Subscriptions, Findings, Policy, and RBAC tabs.
  5. Use View Details on a subscription with elevated risk or incomplete coverage.
  6. Review subscription findings, policy exemptions, RBAC inheritance, privileged assignments, and custom roles.
  7. Open Global Admins to check permanent, unresolved, direct, and group-derived tenant administrators.
  8. Switch to Graph when you need to understand inheritance or relationships between policies, assignments, roles, and principals.

Technical reference​

ComponentDetails
Primary scopeSelected company and Azure cloud account.
Optional drill-throughSelected Azure subscription.
Graph filtersText search, node-type filter, reset action, minimap, and graph controls.
Visible errorsSeparate error states for tenant report, subscription report, and graph data.

How it differs from Azure-native views​

The Azure portal is where you change policy assignments, exemptions, RBAC, roles, or management group structure. Spotto Governance does not change them; it brings the evidence from Management Groups, Policy, IAM, Entra ID, and Resource Graph together so you can review posture, troubleshoot changes, and decide what needs follow-up.

Troubleshooting​

Governance report could not be loaded​

What you're seeing: The page shows Governance report could not be loaded.

Likely causes:

  • The tenant governance collection has not completed yet.
  • The selected cloud account is unavailable.
  • Spotto could not retrieve the governance report for that scope.

How to fix:

  1. Refresh the page and try again.
  2. Confirm the selected cloud account is the account you expected.
  3. If the issue persists, wait for the Azure tenant governance collection to complete and retry.

No governance report data found​

What you're seeing: The page shows No governance report data found.

Likely causes:

  • The selected cloud account has not returned tenant governance data yet.
  • Governance collection completed without report data for that account.

How to fix:

  1. Check whether another cloud account has governance data.
  2. Confirm the Azure account still has subscriptions connected to Spotto.
  3. Retry after the next collection run.

Subscription governance could not be loaded​

What you're seeing: The subscription section shows Subscription governance could not be loaded.

Likely causes:

  • The selected subscription report is unavailable.
  • The subscription was removed, renamed, or is no longer accessible.
  • The report is still processing.

How to fix:

  1. Select another subscription and confirm tenant data loads.
  2. Return to the original subscription and retry.
  3. Refresh the page if the subscription was recently added or changed.

Governance graph could not be loaded​

What you're seeing: The Graph tab shows Governance graph could not be loaded.

Likely causes:

  • The graph artifact is still processing for the selected scope.
  • Graph data is unavailable for the selected tenant or subscription.

How to fix:

  1. Refresh the page and retry the Graph tab.
  2. Switch between tenant and subscription scope to see whether one graph is available.
  3. Use the Overview tables while the graph artifact finishes processing.

No matching graph nodes​

What you're seeing: The Graph tab shows No matching graph nodes.

Likely causes:

  • Search text is too specific.
  • The selected node type filter excludes matching nodes.

How to fix:

  1. Clear the search box.
  2. Set the node-type filter back to All node types.
  3. Use Reset to return the graph to its default view.
Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation