Entra ID Entitlement Management: Access Packages Complete Guide · CloudEngineerHub
Entra ID11 min read5 views
Entra ID Entitlement Management: Access Packages Complete Guide
Master Microsoft Entra ID Entitlement Management: catalogs, access package policies, approvals, and lifecycle automation for compliant onboarding at enterprise scale.
A
Anuradha Kumari
Published: August 13, 2026· Last Updated: September 24, 2026·11 min read
Entra ID Entitlement Management: Access Packages Complete Guide
Onboarding a project contractor in a mid-size enterprise typically involves six tickets, three approval chains, and a week of waiting before the user can actually open the SharePoint site they were hired to work in. Entitlement Management — a capability of Microsoft Entra ID Governance — replaces that manual choreography with a single, auditable object: the access package. Users request it, the right people approve it, and Entra grants and later revokes every underlying entitlement automatically.
Visual Walkthrough
Bundle roles, groups and apps into one governed, expiring request.
Expiration + access reviews keep the package honest.
Entitlement Management — Access Package Journey. 1. Catalog created: Resources grouped per team/role into a catalog. — 2. Access package built: Group + app + role memberships bundled. — 3. Policy defines request path: Who may request, approvers, duration, reviews. — 4. User requests access: My Access portal with business justification. — 5. Approval + expiry: Approvers decide; access auto-expires per policy. — 6. Lifecycle enforced: Expiration + access reviews keep the package honest.
A
Anuradha Kumari
Author
Endpoint management specialist focused on Microsoft Intune, Windows Autopilot and modern EUC. Writes practical deployment, compliance and troubleshooting guides for IT teams.
This guide covers the full implementation path: catalogs, resource roles, package policies, approval workflows, and lifecycle handling. The goal is not just to click through the portal but to design a model that survives audits and delegation.
Prerequisites
Licensing: Microsoft Entra ID P2 (included in Microsoft 365 E5) or the Microsoft Entra ID Governance standalone SKU for every user who creates, requests, or is assigned an access package. Guests covered by connected organizations follow the same P2 requirement.
Roles: Global Administrator or Identity Governance Administrator to bootstrap catalogs; catalog owners and access package managers for delegated operations.
Resources ready: the Microsoft Entra security groups, Microsoft 365 groups/Teams, enterprise applications, and SharePoint Online sites you plan to bundle, with owners identified.
Naming standards: agree on catalog, package, and policy naming (for example, cat-projects > pkg-project-alpha-contractor) before you create anything.
Connected organizations (optional): configured in the Entra admin center if external B2B users need to request packages.
How It Works
Entitlement Management has four building blocks, and understanding their relationships prevents most design mistakes:
Catalog: a container for resources (groups, teams, apps, SharePoint sites) and the access packages built from them. A resource can live in only one catalog at a time, so catalog design is a one-way decision — align catalogs with business ownership (IT, Finance, Projects), not with org-chart churn.
Access package: the product users actually see. It bundles one or more resource roles — for example, Member of group grp-project-alpha, Contributor on site PROJ-Alpha, and the Project Web App enterprise application. The package itself grants nothing until a policy exists.
Policy: the rulebook on top of a package. Each policy answers four questions: who can request, who approves, how long the assignment lasts, and what reviews apply. One package can carry multiple policies (employees vs contractors vs external partners).
Assignment: the actual grant tying a user to a package with start and end dates. Expiration, extension, and access reviews operate on assignments, which is why access is automatically revoked without anyone filing a "leaver" ticket.
The request flow is: user opens the My Access portal (https://myaccess.microsoft.com), selects the package, provides justification and any custom questions, and submits. Entra evaluates the policy, triggers the approval chain (manager, sponsor, or designated approvers — optionally two-stage), and on approval creates the assignment and injects the user into every resource role in the package. Expiration and access reviews remove it the same way.
Step-by-Step Implementation
1. Create the catalog
In entra.microsoft.com, go to Identity Governance > Entitlement Management > Catalogs and create a catalog (for example, cat-projects). Assign a catalog owner from the business, not just IT. Catalog owners can then create and manage their own packages without Identity Governance administrators touching every request.
2. Add resources
Open the catalog and add the resources it should manage: security groups, Microsoft 365 groups/Teams, enterprise applications, and SharePoint sites. If a resource belongs to another catalog, you must remove it there first — this is the constraint teams discover at the worst moment, so inventory resources before you start.
3. Create the access package
Under Entitlement Management > Access packages, create a package inside the catalog. Add resource roles: pick each resource and select the role users should receive (Member/Owner for groups, site role for SharePoint, an application role for apps). Keep the bundle minimal — a package named "Project Alpha Contractor" should not carry company-wide memberships.
4. Write the first policy
Add a policy to the package. Configure:
Who can request: "For users in your directory" (employees), "For users not in your directory" (connected organizations/B2B), or "None (administrator direct assignments only)" for break-glass provisioning.
Approvals: require manager approval for employees; for contractors use a designated approver or the resource sponsor. Enable two-stage approval for high-impact packages (stage 1: manager, stage 2: resource owner). Require justification.
Requestor information: add custom questions (contract number, project code) with editable-by-approver flags so mistakes can be corrected without a new request.
Assignment lifecycle: duration (days, or "permanently eligible"), whether users can extend, and whether an access review is required before an extension is granted.
5. Test the end-to-end flow
Request the package as a pilot user, watch the approval email, approve, and verify the assignment. Confirm group membership and SharePoint permissions appear within minutes. Then remove access by shortening the assignment end date and confirm revocation actually removes the user from the underlying groups — this is the step auditors care about.
6. Publish and delegate
Share the My Access portal link with the request audience (https://myaccess.microsoft.com/@your-tenant-domain). Assign access package managers and sponsors so day-two operations (approvals, renewals, questions) land with the business instead of the IAM team.
Configuration Deep Dive
Approval design. Manager approval leverages the directory's manager attribute — garbage in, garbage out. Audit the manager attribute before rollout, or requests will route to former employees. For external users, sponsors are mandatory: a connected-organization policy without a valid sponsor fails closed.
Multiple policies, one package. Employees and vendors should never share a policy: separate policies give different approvers, durations (employees: 180 days with extension; vendors: 30-90 days without), and reviews. Entra evaluates policies top-down, so put the most specific audience first.
Access reviews inside packages. Configure quarterly reviews on the package so reviewers see assignments in business context ("Project Alpha access") instead of raw group sprawl. Reviewers can remove individual users; removal tears down every resource role in the package at once.
Expiration vs reviews. Expiration is your coarse control (access dies on a date); reviews are your fine control (access continues only if someone attests to it). High-privilege bundles should use short durations plus reviews; low-risk bundles can lean on longer durations alone.
Connected organizations. Before external users can request anything, configure the connected organization (the partner tenant) in Entitlement Management and decide which users in that tenant are in scope. Without this, "For users not in your directory" policies have nothing to match.
Real-World Enterprise Scenario
A consulting firm staffs 300-500 external contractors on rolling projects. Historically each kickoff spawned a spreadsheet: who needs the project Teams site, which app role, which VPN group. Offboarding was worse — contract ends, ticket closed, group memberships lingered for months.
The IAM team rebuilt this with one catalog (cat-delivery) and one access package per project, two policies each (internal staff, external contractors). Contractors request via My Access with the purchase-order number as a custom question; the project manager approves as sponsor; assignments expire on the contract end date. Quarterly reviews let delivery managers attest their contractor list in four minutes. The outcome: contractor access now expires by construction, not by reminder, and provisioning time dropped from days to about two hours — almost all of it approval latency.
PowerShell for Access Packages
Microsoft Graph is the automation surface for Entitlement Management. Connect and list packages:
PowerShell
1
2
3
4
5
6
7
# Connect with the Entitlement Management scopes
Connect-MgGraph -Scopes"EntitlementManagement.Read.All"# List all access packages with their catalog$packages = Invoke-MgGraphRequest -Method GET -Uri"https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages?`$expand=catalog"$packages.value | Select-Object id, displayName, catalogId | Format-Table
# Expected output: a table of package ids, display names and catalog ids
Create an assignment request on behalf of a user (the same call the My Access portal makes):
PowerShell
1
2
3
4
5
6
7
8
9
10
11
12
13
Connect-MgGraph -Scopes"EntitlementManagement.ReadWrite.All"# Submit an assignment request for an existing access package$body = @{
requestType = "AdminAdd"
accessPackageId = "<access-package-id>"
target = @{ principal = @{ id = "<user-object-id>"; "@odata.type" = "#microsoft.graph.user" } }
} | ConvertTo-Json -Depth5
Invoke-MgGraphRequest -Method POST `
-Uri"https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackageAssignmentRequests" `
-Body$body -ContentType"application/json"# Expected output: the created request object; poll accessPackageAssignments until it resolves
Use GET on accessPackageAssignments filtered by package to build a compliance report of who currently holds what — the exact evidence auditors ask for.
Visual Walkthrough
Just-in-time privilege: the audited path from standing eligibility to action.
Interactive FlowPIM Activation — Eligible to Active, Safely6/6
1
Eligible assignment
Admin holds the role as eligible — not active — by default.
request
2
Request activation
Justification + ticket reference required by policy.
gate
3
MFA + approval
Authentication strength and approver gate (if configured).
active
4
Time-boxed active role
Role active for the configured window only.
audit
5
Everything audited
Activation, actions and expiry logged for review.
6
Auto-expiry
Window closes; admin returns to eligible state.
PIM Activation — Eligible to Active, Safely. 1. Eligible assignment: Admin holds the role as eligible — not active — by default. — 2. Request activation: Justification + ticket reference required by policy. — 3. MFA + approval: Authentication strength and approver gate (if configured). — 4. Time-boxed active role: Role active for the configured window only. — 5. Everything audited: Activation, actions and expiry logged for review. — 6. Auto-expiry: Window closes; admin returns to eligible state.
Troubleshooting
Symptom
Likely cause
Fix
Package not visible in My Access
No policy matches the user's audience (directory vs connected organization)
Verify the policy's "who can request" scope and that the user is in scope
Request stuck in "Submitted"
Approver has left the org or the manager attribute is stale
Fix the manager attribute; reassign approvers in the policy; use admin direct assignment as break-glass
Cannot add resource to catalog
Resource already belongs to another catalog
Remove it from the old catalog first; plan catalog boundaries before rollout
Guest never receives approval email
Connected organization misconfigured or sponsor invalid
Revalidate the connected organization and sponsor accounts
Access not revoked after expiration
Underlying group was manually assigned outside the package
Remove direct assignments; manage the group exclusively through packages
Common Errors
Error
Meaning
Resolution
"No policy was found that matches the user"
The request audience does not satisfy any policy
Add a policy for that audience or correct the user's membership
"The resource is already in another catalog"
One catalog per resource rule
Remove the resource from the previous catalog, then add it
Approval emails not sent
Notifications misconfigured or mailbox rules filtering external mail
Check policy notification settings and approver mailboxes
Model catalogs on business ownership, not org structure; rename-safe design beats convenience.
One package per business purpose; resist the mega-package that bundles everything "just in case".
Separate policies per audience — employees, contractors, and partners have different lifetimes and approvers.
Prefer expiration plus short durations over "permanent" assignments; use extension flows for legitimate long-term needs.
Run quarterly access reviews on high-impact packages and store the outcome for audit.
Never hand-manage groups inside a package; direct memberships bypass revocation.
Automate assignment reporting via Graph and push it to your SIEM or GRC tool monthly.
Security Considerations
Entitlement Management concentrates both power and risk in a single object: whoever can edit a policy can broaden an audience or remove an approval stage. Restrict Identity Governance Administrator and catalog-owner assignments, and put those roles under PIM eligibility rather than standing access. For external collaboration, always require sponsor approval on connected-organization policies and enable requestor justifications — they are your paper trail when a B2B account is later implicated in an incident. Finally, exclude break-glass administrative accounts from package-driven groups so an access review can never lock out your emergency access.
FAQ
Do I need Entra ID Governance if I already have Entra ID P2?
Core Entitlement Management (catalogs, packages, policies, reviews) runs on P2. The Governance SKU adds lifecycle workflows; start with P2 and upgrade only if joiner-mover-leaver automation beyond packages is required.
Can users request packages from a mobile device?
Yes. The My Access portal is browser-based and responsive; there is no separate mobile app requirement.
What happens to assignments when a user's manager changes?
Existing assignments are untouched. Only future approval routing uses the new manager. Plan a review if manager changes are frequent in your org.
Can I include on-premises AD group access in a package?
Yes — groups synced to Entra ID (including write-back scenarios) work like any other group resource, which makes packages the cleanest way to gate on-prem apps in hybrid estates.
How fast does revocation propagate?
Assignment removal is near-immediate at the Entra layer; downstream apps depend on their token lifetime, so expect up to an hour for services honoring cached group claims.
Conclusion
Entitlement Management turns access from a ticket queue into a governed product: a bundle, a policy, and an audit trail. The organizations that get value from it are the ones that treat catalog and package design as architecture — aligned to business ownership, with lifetimes and reviews baked in from day one. Start with one painful, contractor-heavy process, prove the model, then scale it outward.
Comments
0No comments yet — be the first to share your thoughts.