Entra ID Governance Portal

Microsoft Entra ID Governance is a set of capabilities within Microsoft Entra ID (formerly Azure Active Directory) that enables organizations to govern identity and access lifecycle at scale. It encompasses three main pillars: Entitlement Management, Access Reviews, and Lifecycle Workflows. The governance portal, accessible at https://entra.microsoft.com under Identity Governance, provides a unified interface to configure and monitor these features.

Traditional identity management often relies on manual processes for granting and revoking access, leading to security risks (over-privileged users) and compliance gaps. Entra ID Governance automates these processes, ensuring that users have only the access they need, when they need it, and that access is regularly certified. This is critical for meeting regulatory requirements like SOX, HIPAA, and GDPR.

Entra ID Governance operates through a combination of policies, workflows, and scheduled tasks. At its core, it uses the Microsoft Graph API to interact with directory objects. For example, an access review creates a review resource in the directory, assigns reviewers, and tracks decisions. When a review completes, the system processes the results (approve or deny) and automatically removes or retains access based on the decisions.

Entitlement Management uses catalogs and access packages. A catalog is a container for related resources (groups, apps, SharePoint sites). An access package defines which resources a user can request, the approval workflow, and the expiration policy. When a user requests access, the system triggers an approval workflow (via Microsoft Entra Identity Governance approvals). If approved, the system automatically assigns the user to the underlying resources (e.g., adds the user to a group).

Lifecycle Workflows are automated workflows triggered by events (e.g., new hire, leave, move). They can execute tasks like sending a welcome email, assigning temporary access pass, or disabling an account. Workflows are defined using a JSON-based definition and run on a schedule or in near real-time.

- Access Reviews: - Review scope: Can be all users, specific users, or group members. - Review recurrence: One-time, weekly, monthly, quarterly, or annually. Default is one-time. - Duration (in days): The review must be completed within this period; after that, the review is stopped and decisions are auto-applied (if configured). Default is 30 days. - Auto-apply: If enabled, decisions are applied automatically after the review duration expires. Default is disabled. - Decision helpers: The system can provide recommendations (based on sign-in activity) to reviewers.

- Entitlement Management: - Catalogs: Each catalog has a unique ID. Resources are added to catalogs. - Access Packages: - Expiration: Access can expire after a set number of days (default 365) or on a specific date. - Approval stages: Up to 2 approval stages. Default is 1 stage. - Requestor must be approved: Default is yes. - Connected organizations: External organizations that can request access. Configured via a list of domains.

- Lifecycle Workflows: - Trigger types: employeeHire, employeeLeave, employeeMove. - Tasks: - sendEmail (sends a custom email) - addUserToGroup - removeUserFromGroup - enableUserAccount - disableUserAccount - generateTemporaryAccessPass - Execution conditions: Workflows can be scheduled to run at a specific time (e.g., 5 days after hire) or immediately.

Using Microsoft Graph PowerShell:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "EntitlementManagement.ReadWrite.All", "AccessReview.ReadWrite.All", "LifecycleWorkflows.ReadWrite.All"

# List access reviews
Get-MgIdentityGovernanceAccessReviewDefinition | Select-Object Id, DisplayName, Status

# Create an access package
New-MgEntitlementManagementAccessPackage -DisplayName "Sales Access" -CatalogId $catalogId

# Get lifecycle workflows
Get-MgIdentityGovernanceLifecycleWorkflowWorkflow | Select-Object Id, DisplayName, State

Using Azure CLI:

az rest --method get --uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions"

The review will appear in the reviewer's My Access portal. After completion, the system applies decisions (e.g., remove denied users from the group).

A multinational corporation must comply with SOX by certifying access to its financial systems every quarter. The company uses Entra ID Governance to create quarterly access reviews for the Finance department's group. The review is set to recur every 3 months with a duration of 30 days. Reviewers are the Finance managers. The system auto-applies decisions after the period ends. The company also enables recommendations based on last sign-in activity. In production, this review covers 500 users and 10 groups. The review process reduces manual effort by 80% and ensures compliance. A common misconfiguration is setting the duration too short (e.g., 7 days), causing managers to miss the deadline and auto-apply revoking access incorrectly. The correct approach is to set duration to at least 14 days and enable reminders.

A tech company uses Entitlement Management to allow external contractors to request access to specific projects. They create a catalog called 'Project X' with a group and a SharePoint site. An access package is published with a two-stage approval: first by the project lead, then by the security team. Access expires after 90 days and can be renewed for another 90 days with a new approval. Contractors request via My Access portal. The system automatically provisions access within minutes. The challenge is managing connected organizations: the company must add the contractor's domain to the allowed list. Without this, external users cannot request. Also, expiration must be enforced to prevent lingering access; a common mistake is setting expiration to 'never'.

A large enterprise with 10,000 employees uses Lifecycle Workflows to automate onboarding. When a new hire is created in the HR system (Workday) and synchronized to Entra ID, the 'employeeHire' workflow triggers after 1 day. It sends a welcome email, enables the user account, and adds the user to the 'All Employees' group. For offboarding, an 'employeeLeave' workflow disables the account after 7 days and removes the user from all groups. The workflows run on a daily schedule. A common issue is that the workflow fails if the user object doesn't have the correct attributes (e.g., 'employeeHireDate' not set). The admin must ensure HR sync populates these attributes. Also, workflows cannot remove the user from dynamic groups; they only work with assigned groups.