Entitle + Azure

Expiring Role Assignments

Create Azure RBAC assignments with an expiration timestamp; Entitle tracks timers and removes the assignment automatically on timeout.

Approval + Reason Capture

Enforce approver sign-off and justification for elevated DB privileges; store the full trail for audits.

Do More than PIM

Apply consistent elevation policies across tenants and subscriptions with conditional logic and centralized auditability that extends beyond native PIM.

• A dedicated service principal with minimal `roleAssignments` rights performs changes. Privileges are limited to the required subscriptions/management groups.

• Each elevation creates an Azure RBAC role assignment with an explicit expiration. Entitle tracks the assignment ID to guarantee deterministic rollback.

• All operations are captured in immutable audit logs (request → approval → assignment → revoke) and can be cross‑checked against Azure Activity Logs.