Removed: 1.4 million unused Microsoft Entra applications, unnecessary critical-privilege Graph directory permissions on production apps, and the whole Azure Service Manager control plane.
Outcome: the Entra figure grew by 176,198 since November; Azure Service Manager retirement is complete across all remaining workload classes, including roughly 800,000 classic SQL storage accounts, with migration to Azure Resource Manager at 100%.
Microsoft counted its own estate and then cut it. The July 2026 Secure Future Initiative report says the company “decommissioned 1.4 million unused Microsoft Entra applications (an increase of 176,198 since November)” and kept “stripping unnecessary critical-privilege Graph directory permissions from production apps, shrinking the lateral-movement surface”.
On the older control plane it states: “Retirement of Azure Service Manager is complete across all remaining workload classes: classic compute, storage (~800,000 classic SQL storage accounts), networking, App Service Environment v1/v2, and API Management v1”, for the stated reason that the legacy access mechanisms it removed “could be abused for credential replay or lateral movement”.
The mechanism is documented in Microsoft’s own pattern write-up, and it is not a big-bang deletion: unused applications are identified from usage and sign-in logs, checked with service owners, soft-deleted with a grace period, then removed permanently. The inventory came first — Microsoft says it centrally tracks “more than 97%” of production infrastructure assets.
Sources: