MANAGED ENTRA ID ADMINISTRATION · SELF-SERVICE
No standing admin rights.Every change an order.Approved means executed.
Entra Logic keeps a live, searchable copy of your entire Entra ID estate — every company, every tenant. Admins, service desk and employees request changes instead of editing the directory; the engine executes exactly what was approved, against Microsoft Graph; one audit trail covers the whole chain, from request to execution.
Start with the free health check: sign in with Microsoft, grant read-only access, and see what your directory actually looks like. No form, no call, no salesperson.
There are two ways to run Entra ID. Both are wrong.
The first way
You hand out permanent admin roles, because someone has to be able to fix things at 16:45 on a Friday. Twelve people can now change anything in the directory, and nobody can reconstruct who did what six months later.
The second way
You lock it down, and every change becomes a ticket. IT retypes what a manager already wrote into a form, in a different system, from memory. The audit trail records the retyping, not the decision.
The order is the change. Approve it, and it happens — with the reason attached.
What we find in the first report
Accounts that should have been gone months ago.
Leaving dates get recorded in HR and never reach the directory. Licenses stay assigned. Group memberships survive the person. None of it is dramatic on its own — it is just never anyone's job, and it accumulates for years.
1,284
Identities read in a typical first scan
3 minutes
From consent to first report
0
People with standing rights afterwards
One order, four lines
Decision and execution, in the same record.
- 09:14:02Line manager orders access for a new hire. Reason required, one sentence.
- 09:14:19Approver sees the exact change, the cost, and who asked. Approves.
- 09:14:31The platform executes it — account, groups, licenses, device policy.
- 09:14:38Order closed. Request, reason, approval and result sit in one record.
No standing rights — not ours either
Zero standing rights — for people.
The platform has them, and that is the entire point: the right moves from twelve people who can do anything at any time, to one service that can only do what an approved order asks for, with a full trail on every action.
Nobody at Entra Logic holds a permanent role in your tenant. Access is granted for a named task and a fixed window, approved by you, and it expires by itself. The permissions we do hold are listed in full on the security page — the same list Microsoft shows you in its own dialog.
Read the security pageSample of what you get for free
The health check report, and the evidence under every finding.
This is the actual output of the free plan: 22 checks across identity lifecycle, privileged access, licenses, devices and data quality — scored, priced, and traceable back to the query that produced it.
The long list
Yes, there is a feature list. It is quite long.
31 features across the health check, orders and approvals, delegation, multi-tenant operations, automation and the parts that decide whether this survives its first year — each one described in a paragraph you can actually evaluate.
Start free, in read-only.
Sign in with Microsoft. Grant read access. Get the report. If you never come back, nothing has changed in your directory — and you can remove the application in four clicks.
How to remove us again
Entra portal → Enterprise applications → Entra Logic → Properties → Delete.
Access ends immediately. Data we have read is deleted within 30 days, or right away if you ask.
We put this here so you know it before you start, not so you have to go looking for it afterwards.