Microsoft Entra ID Governance

Licensing

Advanced Identity governance has now a new license set and you can acquire it as a addon called Step Up. Some older functionalities still live inside P1 and P2 licensing models.

Here the list of feature available only from ID Governance license

Why to use?

The features will help you to enhance efficiency by guaranteeing timely access for individuals without the need for manual approvals, enhance security by minimizing the risk associated with access misuse and implementing intelligent access decisions driven by machine learning and streamline the authorization procedure for standard resource access, allowing you to concentrate on insights and exceptional cases provided by AI.

You can see the use cases from Learn. They have examples on all the different features under the license.

Microsoft Entra ID Governance licensing fundamentals – Microsoft Entra

This article describes shows the licensing requirements for Microsoft Entra ID Governance features.

How to access?

Just open Entra admin center (https://entra.microsoft.com) and navigate to Identity governance. Note that ID Governance preview feature will be moved under new licensing model at 30th of September.

You need to be at least Identity Governance Admin to access these features.

Azure AD built-in roles – Microsoft Entra

Describes the Azure Active Directory built-in roles and permissions.

And the portal overview.

Under Identity governance portal you will find the following

ID Governance features

Entitlement management

And what you could do with it. Well, you can request additional identity documents, like training certifications or work authorizations, during the request process. As the access package manager, you can require requestors to provide verified IDs with these credentials from trusted issuers. Approvers can then easily confirm if the user’s verifiable credentials were validated when they submitted the request.

See more from Learn

Configure verified ID settings for an access package in entitlement management – Microsoft Entra

Learn how to configure verified ID settings for an access package in entitlement management.

But you can also use

Access reviews

Access reviews is a component of Microsoft Entra ID, it will empower organizations to effectively oversee group memberships, access to enterprise applications, and role assignments. Regularly reviewing user access ensures that only authorized individuals maintain ongoing access privileges.

With the new license features you could in example review Inactive guest users

Monitor and clean up stale guest accounts – Microsoft Entra

Monitor and clean up stale guest accounts using access reviews

And not to forget PIM and the advanced features the new licenses unleashes

Privileged Identity Management

Privileged Identity Management (PIM) involves the supervision and safeguarding of high-privileged accounts within an organization’s IT ecosystems.

This oversight is essential to prevent the potential misuse or abuse of the extensive access capabilities associated with super control accounts. Unmonitored super user accounts pose risks such as.

• The loss or theft of sensitive corporate data
• Introduction of malware that could compromise the network.

With the new licensing model you can enable PIM for Groups, to enable automation on groups

Create an access review of PIM for Groups (preview) – Microsoft Entra

Learn how to create an access review of PIM for Groups in Azure Active Directory.

And you can read more from my previous blogs. Author note! Azure AD is now Entra ID

Lifecycle workflows

And finally for Lifecycle workflows, which can be used for the following entities:

• Joiner: An individual who enters the realm of requiring access, such as a new employee joining a company or organization.
• Mover: An individual who transitions within an organization, often necessitating changes or expansions in their access and authorization. For instance, someone who moves from a marketing role to a sales position
• Leaver: An individual who departs from the realm of needing access, often prompting the removal of their access privileges. Examples include retirees or terminated employees.

See more from Learn.

Understanding lifecycle workflows – Microsoft Entra

Describes an overview of Lifecycle workflows and the various parts.

Closure

You can get the trial for Entra Identity Governance here https://aka.ms/EntraIDGovTrial or use Step up for the full license.

Some of features I already covered in my previous posts and good to see them going forward. Sometimes paywall comes between you and a feature and most of the times it’s there for a reason.

You can argue that it shouldn’t but it will give you more advanced features that you can secure your Identity estate.

And there is still ones that you can use without a new license.

You find the full Entra Identity Governance documentation from Learn

Microsoft Entra ID Governance documentation – Microsoft Entra

Learn how to protect, monitor, and audit access to critical assets while ensuring employee productivity.