Microsoft Entra ID Governance: Access Reviews, Entitlement Management, and PIM Operations · CloudEngineerHub
Entra ID11 min read6 views
Microsoft Entra ID Governance: Access Reviews, Entitlement Management, and PIM Operations
Operate Entra ID Governance end to end: access reviews with auto-apply, entitlement management packages, PIM day-2 operations, and Graph PowerShell for automation and evidence.
A
Anuradha Kumari
Published: August 24, 2026· Last Updated: September 28, 2026·11 min read
Microsoft Entra ID Governance: Access Reviews, Entitlement Management, and PIM Operations
Entra ID Governance (the Entra ID P2 feature set) is what separates "we can grant access" from "we can prove who has access, why, and when it ends." This post covers the three operational pillars — access reviews, entitlement management, and Privileged Identity Management (PIM) — from the perspective of an admin who has to run them every month, not just demo them once.
Visual Walkthrough
Governance is a loop: attest, remove, and repeat on schedule.
Lifecycle LoopAccess Reviews — The Recertification Cycle6/6
1
Define review scope
Groups, apps or Entra roles; reviewers and cadence set.
notify
2
Reviewers notified
Certificate of access requests arrives with recommendations.
attest
3
Attest decisions
Approve / deny / delegate — deny auto-applies on completion.
remove
4
Denied access removed
Membership or assignment removed automatically, logged.
archive
5
Evidence archived
Decision history retained for audit and ISO/SOC evidence.
6
Next cycle scheduled
Recurring reviews keep the estate continuously clean.
Continuous cycle
Access Reviews — The Recertification Cycle. 1. Define review scope: Groups, apps or Entra roles; reviewers and cadence set. — 2. Reviewers notified: Certificate of access requests arrives with recommendations. — 3. Attest decisions: Approve / deny / delegate — deny auto-applies on completion. — 4. Denied access removed: Membership or assignment removed automatically, logged. — 5. Evidence archived: Decision history retained for audit and ISO/SOC evidence. — 6. Next cycle scheduled: Recurring reviews keep the estate continuously clean.
A
Anuradha Kumari
Author
Endpoint management specialist focused on Microsoft Intune, Windows Autopilot and modern EUC. Writes practical deployment, compliance and troubleshooting guides for IT teams.
Licensing: Entra ID P2 for access reviews, PIM, and Identity Protection; entitlement management is included in the Governance suite and requires P2 as well.
Roles: Identity Governance Administrator for reviews and packages, Privileged Role Administrator for PIM role settings, User Administrator for group hygiene.
Microsoft Graph PowerShell (SDK module) for the automation samples; a service principal with AccessReview.ReadWrite.All and RoleManagement.ReadWrite.Directory consent.
Manager and sponsor attributes populated in HR data — approval chains in packages and lifecycle workflows depend on them.
Connected organizations configured if external partners will request access packages.
Access to entra.microsoft.com under Identity Governance.
How the Three Pillars Fit Together
Think of governance as three questions with three owners. Entitlement management answers "how should access be granted?" — access packages bundle groups, apps, and SharePoint sites behind approval policies with built-in expiry. Access reviews answer "who still needs it?" — scheduled recertifications that can auto-remove denied access. PIM answers "who is elevated right now?" — just-in-time activation instead of standing privilege. Lifecycle workflows join the pillars by automating joiner-mover-leaver: a hire-date trigger assigns the access package, a leaver trigger strips memberships and revokes sessions. Operated together, grants are approved and expiring, attestations are enforced, and privilege is measured in hours — which is the evidence trail auditors actually want.
Access Reviews That Actually Recertify Access
An access review is a scheduled recertification: designated reviewers approve or deny each user's access, and with Governance licenses the system can auto-remove denied access when the review completes. You build them at entra.microsoft.com under Identity Governance > Access reviews. The settings that decide whether a review is real or theater:
Scope: group members, users assigned to an application, or service principals with role assignments. Service principal reviews are the most commonly skipped — managed identities and app registrations quietly accumulate Contributor on subscriptions nobody remembers granting.
Auto-apply results: configure "if reviewers don't respond, remove access." Silence should mean revocation, not permanence.
Cadence and templates: quarterly for privileged groups, use the built-in "Guest users with access to groups" template for external collaboration sprawl.
Automating review creation with Microsoft Graph PowerShell keeps cadence consistent across hundreds of groups:
The DefaultResult = "None" plus auto-apply combination is deliberate: non-responses become removals, which is the behavior auditors actually want.
Entitlement Management: Package the Access, Not the Emails
Entitlement management (Entra admin center > Identity Governance > Entitlement management) wraps groups, apps, and SharePoint sites into catalogs, then exposes them as access packages governed by policies: who can request, who approves, how long access lasts, and whether it renews. The operational win is that the policy engine replaces ticket queues — a request from a connected organization routes to the manager or sponsor for approval, grants membership for 90 days, and expires without anyone filing a deletion ticket.
Build order that works: create the catalog, add resources (groups first, then apps and sites), define the access package, then attach policies per audience — employees, contractors, external partners — because each audience wants a different approval chain and duration. Pair it with Lifecycle workflows (also under Identity Governance) for joiner-mover-leaver: trigger a workflow on hire date to add the new hire to the access package, and a leaver workflow to remove group memberships and revoke sessions on the last day of employment. This closes the classic gap where departed contractors keep app access for months.
PIM: No Standing Privilege, Ever
Privileged Identity Management makes tier-0 roles just-in-time: administrators are eligible rather than permanently active, activation requires MFA and a justification, and Global Administrator activation can require a second admin's approval. The day-2 operations that keep PIM healthy:
Zero standing Global Administrator and Exchange Administrator assignments — eligibility only, 4-hour max activation.
Review PIM alerts monthly ("Roles don't require MFA for activation", "Too many global administrators") at Identity Governance > Privileged Identity Management > Microsoft Entra roles > Alerts.
Use PIM for Groups so application-scoped roles (Intune Administrator, User Administrator) also go just-in-time — the group is PIM-managed, and role assignments flow through nested membership.
Automate activation in scripts with Graph rather than scraping the portal:
62e90394-69f5-4237-9190-012177145e10 is the Global Administrator role template ID; swap in any other template ID from the role list for scoped activations.
Real-World Enterprise Scenario
A finance-adjacent SaaS company ran quarterly SOX recertification across 14 applications. Before Governance: 3,000-line spreadsheets emailed to managers, 11% response rate, no removals ever processed. After: three access reviews (employee app access, guest users, service principals), auto-apply on, non-response equals removal. The first cycle removed 218 dormant assignments — including a service principal with Contributor on the production subscription that a vendor integration left behind two years earlier. Evidence for the auditors became a Graph export of the review definition, decisions, and completion history instead of a spreadsheet. The operational lesson: reviews only work when the default behavior is removal, and the scariest findings are always in the scopes nobody thought to review.
Configuration Deep Dive
Review settings that matter: DefaultResult = "None" + AutoApplyDecisionsEnabled makes silence a revocation; JustificationRequiredOnApproval creates an audit trail; reminders at day 3 and day 7 keep response rates above 90%.
Package policies: 90-day duration with renewal for employees; 30-day for external users with sponsor approval; require approval for every external grant — self-service expiry is cheaper than incident response.
PIM role settings: max activation 4 hours for tier-0, MFA on activation always, approval required for Global Administrator, and notifications on activation sent to the security alias — not the user.
Lifecycle workflows: start with a leaver workflow (remove memberships, revoke sessions, delete accounts after N days); joiner workflows are valuable, leaver workflows are urgent.
Troubleshooting Governance Operations
Symptom
Likely Cause
Fix
Review completes but access is not removed
Auto-apply disabled or DefaultResult = "Approve"
Enable auto-apply, set DefaultResult to None; rerun the review period
Reviewer cannot see the review blade
User lacks P2 license or governance role assignment
Assign Entra ID P2 and Identity Governance Administrator (or make them group owner-reviewer)
Access package request stuck "awaiting approval"
Approver attribute empty or sponsor missing
Fix manager/sponsor on the requesting user; add fallback approvers in the policy
PIM activation denied immediately
MFA not registered or role requires approval
Complete MFA registration; route to the approver or adjust role settings deliberately
Lifecycle workflow never fires
Trigger attribute (hire/leave date) empty in HR sync
Correct the attribute source; check workflow run history for the failed trigger
Common Errors
Graph 403 "Insufficient privileges" — consent missing; rerun Connect-MgGraph with the full required scopes and have a Global Administrator consent tenant-wide.
400 "Invalid query" on review scope — the scope query string is malformed; validate against the Graph schema before saving the definition.
"You do not have access to Identity Governance" — P2 license not assigned to the operator account; licenses gate the feature, not just the roles.
PIM "Activation failed — role already active" — an existing unexpired assignment; extend or revoke first instead of stacking activations.
Visual Walkthrough
Just-in-time privilege: the audited path from standing eligibility to action.
Interactive FlowPIM Activation — Eligible to Active, Safely6/6
1
Eligible assignment
Admin holds the role as eligible — not active — by default.
request
2
Request activation
Justification + ticket reference required by policy.
gate
3
MFA + approval
Authentication strength and approver gate (if configured).
active
4
Time-boxed active role
Role active for the configured window only.
audit
5
Everything audited
Activation, actions and expiry logged for review.
6
Auto-expiry
Window closes; admin returns to eligible state.
PIM Activation — Eligible to Active, Safely. 1. Eligible assignment: Admin holds the role as eligible — not active — by default. — 2. Request activation: Justification + ticket reference required by policy. — 3. MFA + approval: Authentication strength and approver gate (if configured). — 4. Time-boxed active role: Role active for the configured window only. — 5. Everything audited: Activation, actions and expiry logged for review. — 6. Auto-expiry: Window closes; admin returns to eligible state.
Best Practices
Quarterly reviews for privileged groups and guests; annual for general app access; service principals every quarter — always.
Auto-apply decisions on every production review; a review without removals is a report, not a control.
Package the 80% of access that is predictable; leave the long tail documented, not improvised.
Zero standing tier-0 privilege; PIM eligibility with MFA and approval.
Export review results and PIM activation history as audit evidence the day each cycle closes.
Security Considerations
Reviews and PIM are P2 controls — license coverage must include every administrator, or the excluded admins are exactly the standing privilege you are trying to eliminate.
Require approval + justification on Global Administrator activation and alert on every activation event.
Guest-driven reviews close the collaboration sprawl that phishing campaigns target first.
Do not grant service principals standing RoleManagement.ReadWrite.Directory; scope automation identities to the minimum Graph permissions and rotate their secrets.
Key Takeaways
Access reviews without auto-apply decisions are security theater — configure silent reviewers to mean revocation.
Entitlement management replaces ticket-based grants with approved, expiring access packages and lifecycle workflows.
Eliminate standing privileged access: PIM eligibility, MFA on activation, approval for tier-0 roles.
Review service principal assignments and PIM alerts monthly, not after the audit finding.
Access reviews, entitlement management, and PIM all require Entra ID P2 licensing.
FAQ
Q: Which Entra license do I need for access reviews?
A: Entra ID P2 for all users in the review scope. Reviewers without P2 cannot access the blade, and scoped users outside licensing make the review results unreliable — license coverage is part of the control.
Q: Can access reviews remove access automatically?
A: Yes — enable auto-apply on completion and set the default result for non-responses to "None" (deny). Denied and unresponsive entries are then removed without manual cleanup.
Q: What should I review first if I can only run one review?
A: Service principals with role assignments. They accumulate standing cloud privileges faster than any human population and almost never get recertified — the highest-risk, least-reviewed scope in most tenants.
Q: How does PIM for Groups differ from PIM for roles?
A: PIM for Groups makes group membership just-in-time; roles assigned through that group inherit the elevation. It extends just-in-time discipline to resources with only group-based assignment models.
Q: How long should PIM activations last?
A: Four hours is a defensible maximum for tier-0 roles — long enough for an incident shift, short enough that forgotten activations expire the same day.
Conclusion
Governance is a practice, not a purchase. Reviews with teeth, packages that expire, and privilege that activates on demand turn "we have P2 licenses" into "we can prove least privilege." Start with the scopes nobody reviews, automate the defaults toward removal, and let the evidence accumulate in Graph instead of spreadsheets.
Lock the concepts in with the AZ-104 practice tests on /mock, automate the reviews with the scripts in /tools, and grab the full identity bundles in /store.
Comments
0No comments yet — be the first to share your thoughts.