Microsoft Entra extensibility is a gift. It is also Control Plane.

Short summary

Microsoft Entra extensibility lets organizations customize identity enforcement through custom functions and workflows, but each extension point becomes part of your privileged access infrastructure. Current Azure landing zone designs weren't built to house these critical systems as Control Plane workloads, creating architectural gaps. Organizations need to rethink subscription placement and RBAC design for extension endpoints that execute on every identity event.

• •Entra extensibility shifts decision-making to external systems (Functions, Logic Apps), making those systems Control Plane
• •Current Azure landing zone architecture doesn't account for extension workloads as privileged infrastructure
• •RBAC inheritance flows downward unbreakably—extension endpoints placed incorrectly inherit excessive privilege

Generated with AI, which can make mistakes.