DE
← Other Athentra features

Module: Control · Execution

Least-Privilege App Registrations

Each control declares the permissions it needs, and Athentra can create a dedicated Entra application per control holding exactly those. Permissions are checked twice: when a run is requested, and again with Microsoft just before it executes, so a run fails before it acts rather than halfway through. The blast radius of any single control is limited to what that control was actually granted.

  1. 01

    Pain Point

    What's the problem?

    One heavily-permissioned service account behind all automation is convenient until somebody audits it.

  2. 02

    Remedy

    How do we attack it?

    Give each control its own app registration holding only the permissions it declares

  3. 03

    Your Value

    What do you get out of it?

    Removes the single over-permissioned identity that automation usually depends on