Post

Joël Prins
@intothecloud.eu

PIM Manager just shipped a major update. 🚀 I planned to build the Configure wizard next. But I realized PIM for Groups behaves fundamentally differently than roles. If I ignored that, I’d be building a tool that only works for half the product. Here is what changed 👇

Joël Prins
@intothecloud.eu

The "Unmanaged Groups" Blind Spot 🚩 While digging, I found a refined security gap. Groups can have isRoleAssignable: true, but no PIM policy attached. They bypass PIM entirely. No activation limits. No MFA. Only permanent privileged access. PIM Manager now identifies these automatically.

Joël Prins
@intothecloud.eu

Under the hood: Delta Queries ⚡ I didn't know Graph Delta Queries existed until I started this. I was fetching everything on every refresh. Thousands of calls. Now? 500+ calls dropped to ~10. It’s a massive win performing huge optimizations.

Joël Prins
@intothecloud.eu

What's in this update: ✅ Full PIM for Groups support (Owner vs Member policies) ✅ Security Gap Detection ✅ Smart Sync (Delta Queries) ✅ Multi-workload Architecture Repo is now PUBLIC 💻 Huge thanks to everyone who provided feedback! 🙌

Joël Prins
@intothecloud.eu

I wrote a detailed deep-dive about the architecture, the hybrid delta/full sync approach, and the logic gaps I found. It's an absolute information bomb on the architecture and logic. Read the full blog here: intothecloud.eu/p/pi... #EntraID #PIM #MicrosoftGraph #CloudSecurity

intothecloud.euYou’re not managing PIM if you can’t see PIM for GroupsAre "Unmanaged Groups" bypassing your Entra ID PIM policies? Discover the security gap in PIM for Groups and how to detect it with the new PIM Manager.

0 reposts0 likes

No replies yet.