NEWFlows V2 has been releasedSee what shipped
INTEGRATIONSCLOUD INFRASTRUCTURE
Azure28 OF 28 CAPABILITIES ASSESSED

Who holds which Azure role, on every scope

Azure role assignments, PIM eligibility and managed identities across management groups, subscriptions and resources, read through your Microsoft connection.

TYPE · INFRAAUTH · MICROSOFT CONNECTIONDOMAIN · AZURE.MICROSOFT.COM
Azure connectorHOURLY SYNCCAPABILITIES
WHAT PLOY DOES
Discover management groups, subscriptions and resource groupsPloy reads one management group and everything below it, normally the Tenant Root Group, so the whole tenant lands in the graph.
READ
Map role assignments to who holds themEvery Azure role assignment on a management group, subscription, resource group or resource, conditional ones included. Each lands on the Entra user, group or service principal it grants.
READ
Read PIM eligibilityRoles a person can activate through Privileged Identity Management sit next to the roles they hold now.
READ
Link managed identities to their resourcesEach managed identity is linked to the resources it is attached to, so machine access is reviewed the way a person is.
READ
2.1WHAT IT UNLOCKS

Three jobs this connector does on day one

REVIEWS

Azure access on the Entra record

Azure grants land on the people, groups and service principals your Microsoft connection already syncs, so a reviewer sees Entra and Azure access in one place.

PRIVILEGED ACCESS

Standing and eligible roles together

PIM eligibility shows beside active role assignments, so an Owner who can be activated is not missed.

NON-HUMAN IDENTITIES

Managed identities are identities

A managed identity carries the resources it is attached to and the roles it holds, instead of hiding inside a resource.

2.3

SETUP

TYPICALLY 10 MINUTES
STEP 01

Connect Microsoft first

Azure reads through the app your Microsoft connection already signs in as. No new secret is stored.

STEP 02

Choose the management group

Enter the management group Ploy reads. Use the tenant ID to read the whole tenant.

STEP 03

Give the app the Reader role

Run the commands Ploy shows in Azure Cloud Shell. They assign Reader on the management group. Then watch the first sync.

2.4OFTEN CONNECTED TOGETHER
MicrosoftIDENTITY SOURCEAmazon Web ServicesCLOUD INFRASTRUCTUREGoogle Cloud PlatformCLOUD INFRASTRUCTURE
BROWSE ALL 138 INTEGRATIONS

Connect Azure, see it in 10 minutes.