📖 What is Microsoft Entra ID Governance?
Microsoft Entra ID Governance is a suite of tools designed to manage the identity lifecycle, including access reviews, entitlement management, and privileged access. It ensures that users have the right access to the right resources for the right amount of time.
"Focus on 'Access Reviews'—the process of periodically auditing who has access to what—as this is a core governance function."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Governance?
- ▸ Access Reviews provide a periodic audit mechanism to certify that users still require specific permissions, effectively preventing permission creep over time.
- ▸ Entitlement Management uses Access Packages to bundle groups, applications, and SharePoint sites, allowing users to request a set of resources via a streamlined workflow.
- ▸ Privileged Identity Management (PIM) enables Just-In-Time (JIT) access, reducing the attack surface by granting elevated roles only when needed and for limited durations.
- ▸ Lifecycle Workflows automate the 'joiner, mover, leaver' process, ensuring that access is granted upon hiring and revoked immediately upon employee termination.
🎯 How does Microsoft Entra ID Governance appear on the MS-102 Exam?
You may be asked to implement a compliance requirement where managers must certify their team's access to sensitive data every 90 days, requiring the configuration of an Access Review.
A scenario might describe a need to provide a temporary contractor with a specific set of resources that automatically expire after 30 days, pointing toward the use of Access Packages.
Expect questions where you must choose between PIM and Access Reviews; remember that PIM manages the activation of roles, while Access Reviews audit the necessity of those roles.
❓ Frequently Asked Questions
What happens if a reviewer does not respond to an Access Review request?
You can configure the review settings to either 'Approve' or 'Deny' access by default if no response is received. In high-security environments, 'Deny' is typically chosen to ensure a zero-trust approach.
How does Entitlement Management differ from simple group membership?
While groups provide access, Entitlement Management wraps those groups into Access Packages with built-in request workflows, approval chains, and automatic expiration dates for a more governed lifecycle.