Runs in your Azure, one identity per part
Container Apps jobs, a web app and an Azure SQL database in your subscription, each part on its own managed identity with only its own rights.
Purpose
A tool that writes identity tags needs rights in the tenant. Those rights should belong to as few parts as possible, with no client secret anyone can steal.
Design
Two lines in PowerShell 7 or Azure Cloud Shell show the plan, then install everything into one resource group. The engine, the scheduler and the web app each sign in as their own managed identity: only the engine has Microsoft Graph rights, the scheduler can only ask for runs, and the web app holds database rights only. Each part has its own database role with grants on the tables it uses. There is no client secret or certificate, and no PowerShell module is needed anywhere.
Business opportunities
Your data stays in your tenant and subscription, and a security review finds a short, explainable list of rights.
Related features
A hybrid worker for Active Directory
Tags of AD-synced users are written in Active Directory by a small worker that only connects out and has no password.
Jobs on your schedule
Every job runs on the schedule you set - daily, weekly or every few hours - with Preview and Apply on demand.
Alert mail from one mailbox only
Alerts are sent from a shared mailbox that the engine may send as - and no other mailbox in the tenant.
API and MCP access
Pro: your own scripts and AI assistants use Entra Policy Suite through its API and an MCP server, under the caller's own role.