Permissions in one place. Activations in another. WatchTower combines both into a single database so you can see the full picture: who has access to what, and how they're using it.
Permissions are in Entra ID. Activations are in Log Analytics. Azure RBAC is somewhere else. To understand privileged access, you're pulling data from three different places.
PIM eligibility in one portal. Activation logs in another. Azure resource roles somewhere else. No single source of truth.
Knowing someone activated Global Admin isn't useful without knowing what else they could have used. Context requires combining data sources.
This simple question requires querying multiple systems. What about PIM groups? What about Azure resource roles? The answer is always "it depends."
WatchTower Permissions Insights + PIM Coach = complete visibility into privileged access.
All permissions and all activation data in one queryable database. Your Azure tenant, your data. Ask any question.
See who has what eligibility AND what they actually activated. Context for every action: "They used Owner but Reader was available."
Understands GATE model. Knows when someone activated via PIM group vs direct assignment. Complete picture of how privileges are obtained.
Directory roles and Azure resource roles together. Unified view across both identity and resource layer privileged access.
Both tools deployed to your Azure environment with expert setup.
Full permissions audit + PIM behavior coaching in a single database you own.
Full permissions audit: Entra ID roles, Azure RBAC, PIM eligibilities, group memberships. Plus activation history with context: what was activated, when, why, and what alternatives existed.
Yes. Use any database tool you prefer. We provide query templates for common questions: "Who can access this resource?", "What did they activate last month?"
Your Azure subscription, your Azure database, your region. Nothing leaves your environment. No SaaS, no data processing in our systems.
Permissions snapshot runs on your schedule (daily/weekly). PIM Coach analyzes activations weekly by default. Both can be adjusted to your needs.
Yes. The system understands GATE (Groups for Activating Targeted Entitlements). It knows when someone activated via PIM group membership vs direct role assignment.
Both Entra ID directory roles and Azure resource roles are included. Unified view across identity and resource layers. Same database, same queries.
No vendor lock-in. Your Azure database. Export, query, integrate with anything. The data is yours forever.
Delivered by a Microsoft MVP with deep expertise in Entra ID, privileged access management, and identity governance.
Database schema designed for complex queries. Join permissions to activations. Ask questions native tools can't answer.
Stop pulling data from three places. Permissions + activations in a single database that answers any question you can ask.
Please sign in to access exclusive premium content
For authorized members only
Sign in with GitHub