Identity Governance
Entitlement management · Access packages · Access reviews · Lifecycle workflows
Practice questions for this topic →
Tools
| Need | Feature |
|---|---|
| Bundle groups, apps and SharePoint sites; self-request with approval and expiry | Entitlement management access packages |
| Let users from specific partner orgs request access | Connected organizations |
| Periodically confirm users and guests still need access | Access reviews (reviewed by owners, managers or the users themselves) |
| Automate joiner, mover and leaver tasks | Lifecycle workflows (ID Governance) |
| Time-limited privileged roles | PIM |
| Require users to accept terms before access | Terms of use (Conditional Access) |
Facts to know
- Entitlement management automates access request workflows, assignments, reviews and expiration: multi-stage approval, time-limited assignments, recurring access reviews, and automatic assignment from attributes such as department. It's built on Entra B2B for external users, who authenticate to their home directory and have a representation in yours.
- With the 'All users (all connected organizations + any new external users)' policy, an approved requester from an unknown organization causes a connected organization to be created automatically. To restrict to named partners, create the connected organizations first and choose 'Specific connected organizations'. Sponsors from the partner can act as approvers.
- Access reviews fit when: too many users hold privileged roles, automation isn't possible, a group is used for a new purpose, access to business-critical data needs recertifying, policy exception lists need review, or group owners must confirm guests. Reviews cover group membership, enterprise application access and role assignments (PIM).
- Lifecycle workflows manage joiner, mover and leaver phases. A workflow has tasks and an execution condition (scope plus trigger), for example emailing a manager 7 days before the employeeHireDate value for new employees. Extend them with Logic Apps.
- Access packages manage only the access assigned through them; access guests already hold from direct invitations needs an access review.
Exam Tips
Tick each tip once you can answer it without looking.
“Partner users self-request access to a project's Teams, SharePoint and app, with approval and 90-day expiry” → Entitlement management access package.
“Only users from Contoso and Fabrikam may request the package” → Connected organizations.
“Guests removed from the directory when their access ends” → Access package lifecycle settings for external users.
“Group owners confirm members every quarter, remove denied automatically” → Access review with auto-apply.
“Inactive guest accounts should be reviewed and removed” → Access review of guests / inactive users.
“Disable account and remove access on employee's last day automatically” → Lifecycle workflows (leaver).
“Licensing for access reviews / entitlement management” → Entra ID P2 or Microsoft Entra ID Governance.
“Lifecycle workflows” → Automate joiner, mover and leaver tasks: tasks plus an execution condition (scope and trigger). Trap: Example: email the manager 7 days before employeeHireDate; extend with Logic Apps.
“When access reviews fit” → Too many privileged users, groups used for new purposes, business-critical access, exception lists, guest confirmation. Trap: They cover groups, enterprise apps and role assignments.
“Entitlement management capabilities” → Multi-stage approval, time-limited assignments, recurring reviews, automatic assignment from attributes. Trap: Built on Entra B2B for external users.