← everything
Entra ID and permissions
A permission model that needs its own consultant.
Directory roles, subscription roles, resource roles, conditional access and a licensing tier that decides which of them you are allowed to use. Nobody is confident what a given account can actually do until it does something, and the audit answering "who granted this" is a different product with a different retention period.