If you manage more than a handful of Azure subscriptions, IAM hygiene quickly becomes one of those tasks everyone knows is important, but few have time to do manually. This script was created to automate one of the most common Azure RBAC cleanup activities: finding and removing Unknown identities from Azure IAM assignments.
Azure role assignments occasionally contain entries where the identity is displayed as Unknown or Identity not found. These typically appear when a user, group, or service principal has been deleted from Microsoft Entra ID while the corresponding RBAC assignment remains in Azure. [learn.microsoft.com]
While these stale assignments may no longer provide access, they clutter documentation, complicate audits, and can create uncertainty during security reviews. As a cloud architect, I prefer keeping IAM environments clean, documented, and easy to understand.
To help automate this process, I created the PowerShell script:
Azure-iam-document_and_remove_unknowns.ps1
