Home › Blog

How to give a contractor access to your Azure tenant safely

Bringing in a contract Azure or security engineer is often the fastest way to get work done. The risk is in how they get in. Too little access and they sit idle for a week; too much and you've handed a stranger the keys to production. Here's a practical way to get it right.

1. Decide what they actually need to touch

Start from the statement of work, not from a role name. Which subscriptions, resource groups, workspaces or tenants does the engagement cover? Which tasks need write access, and which only need read? Writing this down before day one makes every later decision easier and gives you something to review access against.

2. Give them an identity you control

Avoid shared accounts and avoid creating "temporary" internal accounts that nobody remembers to remove. Common approaches are inviting the contractor as a Microsoft Entra ID B2B guest using their own organisation's identity, or issuing a dedicated account in your tenant that is clearly labelled as external. Either way, the account should be individual, named and easy to find when the engagement ends.

If the contractor works through a managed service provider that looks after several customers, Azure Lighthouse is worth considering: it lets the provider manage delegated resources from their own tenant, with the access you have agreed.

3. Apply least privilege with Azure RBAC

Assign built-in roles such as Reader or Contributor at the narrowest scope that works — a resource group rather than a whole subscription, a subscription rather than a management group. Avoid Owner and User Access Administrator unless the work genuinely needs them, and use custom roles if built-in ones are too broad.

4. Make admin access just-in-time

Standing admin rights are the biggest risk. If your licensing includes Microsoft Entra Privileged Identity Management (PIM), make privileged roles eligible rather than permanent, so the contractor activates them for a limited time with a justification, and optionally an approval. This keeps powerful permissions switched off most of the time.

5. Protect the sign-in

• Require multi-factor authentication for every external account, with no exceptions.
• Use Conditional Access to set rules for where and how external users can sign in.
• Decide up front whether contractors may use their own devices or must use a managed device or virtual desktop.

6. Log it and review it

Make sure Entra sign-in logs and Azure activity logs are retained and, ideally, sent to your SIEM. Set a calendar reminder — or use Entra access reviews if you have them — to confirm every few weeks that each contractor's access still matches the work. Access that was right in week one is often too much by week ten.

7. Plan the exit on day one

Agree an end date for every account and role assignment when you grant it. On the last day, remove role assignments, disable or delete the account, revoke sessions, rotate any secrets or keys the contractor could see, and hand over documentation. A short offboarding checklist turns this from a scramble into a ten-minute job.

Don't forget the contract side

Access controls work best alongside a clear contract: confidentiality terms, data protection obligations and, where personal data is involved, the right UK GDPR or US privacy terms. For engineers based outside the UK, see our guide to hiring offshore Azure engineers. Contractor status rules still apply too — our IR35 vs 1099 guide covers the basics, and professional advice is worth taking for your own situation.

We place contract Azure and cloud engineers and security specialists who are used to working inside clients' access controls from day one. If you have a role to fill, get in touch.

Frequently asked questions

Should a contractor be a guest user or have an internal account?

Both can work. A B2B guest account uses the contractor's own organisation's identity, while a dedicated internal account gives you more direct control. Whichever you choose, keep it individual, clearly marked as external and time-limited.

Should contractors ever have Owner access?

Rarely. Use the narrowest built-in or custom role that does the job, at the smallest scope, and make any privileged role time-limited through just-in-time activation where your licensing allows.