The Tenant

First contact

A payment processor, two hundred staff, going into a DORA readiness review. Every role assignment in the subscription pulled and every principal resolved back to a person. Most resolved. Thirty-four mapped to nothing anyone present could explain. One of those was Owner, at subscription scope, and had been for a year after its holder stopped working there. “That’ll be a service account,” someone said. It was not a service account.

Behaviour

It arrives through the front door, invited. Someone needs Contributor at eleven at night to get through an incident and is granted it, correctly, by somebody with the authority to grant it. The incident ends. The grant does not. It never escalates and never acts — it simply remains after the person it belonged to has gone, and nothing in an estate is built to notice the difference between a colleague and the shape one leaves behind.

The contractor was off the payroll. He was off the badge system. He was not off the subscription, because no system in the building had ever been asked to connect those three facts.

Signs of infestation

Enumerate every role assignment across your subscriptions, inherited included, and resolve each principal. Azure will say so directly when it cannot — orphaned assignments return as Identity not found. Then take the ones that do resolve and write the business justification for each. Not the ticket number. The justification. Anything at Owner or Contributor scope that cannot be justified in one sentence is a resident.

Containment

Deleting an assignment takes four seconds and settles nothing. An auditor will not write up the contractor. They will write up the absence of the review that would have found him, because the control failure is structural rather than individual. Removal without a recurring review buys you one fewer.