Most engineers think…
Most people hear 'Identity Governance' and think it is just a compliance checkbox — some auditor's spreadsheet made digital. That mental model costs you in interviews and in production.
Entra Identity Governance is an active enforcement engine: it decides who gets access, automates the request and approval workflow, periodically recertifies that the access is still needed, revokes it when a person leaves, and gates sensitive apps behind a signed terms of use. Understanding the four pillars — entitlement management, access reviews, lifecycle workflows, and terms of use — is what separates a governance engineer from someone who just clicks 'Approve'.
① The four pillars of Entra Identity Governance
Microsoft Entra Identity Governance sits on top of Entra ID (formerly Azure AD) and answers one question at every stage: who should have access, why, and for how long? It does this through four pillars that cover the full identity lifecycle.
Entitlement management handles self-service access requests — users pick an access package, get approved by a policy, and receive the bundled roles automatically. Access reviews periodically ask owners or managers 'does this person still need this access?' and auto-revoke on no response. Lifecycle workflows automate tasks at the joiner, mover, and leaver stages — generating a welcome email on day one or disabling an account within hours of a termination. Terms of use integrate with Conditional Access to require policy acceptance before a user can reach a sensitive app.
Together these pillars let an organisation govern access at scale with auditable records — without relying on manual IT tickets for every role change.
Which Entra Identity Governance pillar is responsible for automating the removal of all group memberships when an employee is terminated?
② Entitlement management — catalogs, packages & separation of duties
Entitlement management works through a three-level hierarchy. A catalog is a container of resources (groups, apps, SharePoint sites) and the access packages built from them. An access package bundles one or more resource roles into a single requestable unit — for example, 'Finance Analyst Access' might include a security group, a SharePoint site, and an app role. A policy on the package defines who can request it, who approves, how long the access lasts, and whether it must be reviewed.
Separation of duties
Separation of duties (SoD) is enforced at the access-package level: you can mark two packages as incompatible, so a user who holds 'Payments Approver' access is blocked from also requesting 'Payments Submitter'. Entra checks existing assignments before granting a new request and returns an error if a conflict is found. An override package can be created for legitimate exceptions — with a separate, stricter approval chain.
Requests flow through a configurable approval workflow (up to two sequential approvers, or none for auto-approve), with email notifications and a self-service My Access portal. Access expires on a set date or after a configurable duration and can be renewed by another review cycle.
A bundle of resource roles (group, app role, SharePoint site) that a user requests as one unit. Governed by a policy that sets approvers, duration, and review cadence.
A container of resources and access packages. Delegation: a catalog owner can manage their packages without being a global admin, enabling self-service governance at department level.
A scheduled recertification cycle. A reviewer (owner, manager, or self) confirms or denies continued access. With auto-apply on, Entra removes denied access automatically when the period closes.
A policy rule that blocks a user from holding two incompatible access packages simultaneously — e.g. cannot be both Payments Submitter and Payments Approver. Prevents internal control violations.
In any interview question about entitlement management, anchor your answer in the three-level hierarchy. A catalog holds resources; an access package bundles those resources into something requestable; a policy on the package controls who can request it, who approves, and how long it lasts. Delegation flows down this hierarchy — a catalog owner manages their packages without needing a global admin role.
A user who holds 'Payments Submitter' access tries to request 'Payments Approver'. What Entra feature blocks this?
③ Access reviews & terms of use — recurring attestation and policy gates
Access reviews are scheduled recertification cycles that ask a reviewer — a group owner, a manager, or the user themselves — 'does this person still need this access?'. Reviews can target security group members, app role assignments, or Microsoft Entra ID role members. You set the frequency (weekly, monthly, quarterly, annually), choose whether to send smart recommendations (last sign-in date, activity), and decide what happens on reviewer inaction: auto-approve, auto-deny, or take no action.
The auto-apply setting is the critical production choice: when enabled, Entra immediately removes or confirms access as soon as the review period closes, without a manual step. Without it, an administrator must apply the results — easy to forget, which defeats the governance goal.
Terms of use
Terms of use are PDF documents uploaded to Entra and attached to a Conditional Access policy. When a user tries to reach an app, the policy checks whether they have accepted the current version of the terms. If not, they must read and accept before access is granted. Acceptance is logged with timestamp and IP for audit. Terms can require re-acceptance on a schedule (e.g. annually) and support per-language versions.
The single most common access review mistake: the review closes, reviewers have denied dozens of users, but access is not removed because auto-apply results was never turned on. An admin must then manually apply results — and often forgets. Always enable auto-apply in production reviews so Entra enforces decisions automatically.
▶ Watch an access request flow from click to revocation
Follow a self-service access request end to end — approval, grant, review, and removal. Press Play for the healthy path, then Break it to see the classic failure.
An access review closes with 30% of reviewers having taken no action. Which setting ensures Entra automatically removes those members?
④ Lifecycle workflows — automating the joiner, mover & leaver cycle
Lifecycle workflows automate identity tasks tied to HR-driven events in the joiner-mover-leaver (JML) cycle. A workflow is a sequence of tasks — send welcome email, add to group, generate temporary access pass, remove group memberships, disable account, delete account — triggered by a trigger condition based on user attributes (e.g. employeeHireDate, employeeLeaveDateTime) or run on demand.
Joiner workflows run before or on the user's start date: create an account in a connected HR system (via inbound provisioning), add the user to the correct groups, and send a manager the temporary access pass. Mover workflows react when an employee changes department or role — revoking old group memberships and granting new ones. Leaver workflows fire on termination: remove from all groups, revoke sessions, disable the account, and after a grace period, delete it from the directory.
Each workflow run produces an auditable workflow history log — which user, which tasks, which succeeded or failed — so you can prove to an auditor that access was removed on the correct day.
Priya at a Mumbai fintech faces this
After six months of rapid hiring, the security team finds that dozens of former contractors still have active group memberships and app role assignments, and no one knows when they left.
Offboarding was done manually via IT tickets. Some tickets were closed without actually removing all access, and no leaver lifecycle workflow or access review was configured.
Pull the Entra audit log and sign-in log — many accounts show no sign-in in over 90 days but still have active group assignments. The entitlement management dashboard shows packages with no expiry date.
Entra Admin Centre ▸ Identity Governance ▸ Access Reviews + Lifecycle Workflows ▸ Leaver categoryCreate a leaver lifecycle workflow triggered on employeeLeaveDateTime: tasks = remove all group memberships, revoke refresh tokens, disable account. Then run a one-time access review on all apps to clean up the backlog, with auto-apply and 'deny on no response'.
Re-check after 30 days: all leavers show disabled accounts, the access review report shows removed memberships, and the audit log proves exactly when each removal occurred.
When auditing a leaver scenario, never rely only on checking whether an account is disabled. Pull the lifecycle workflow history log for that user: it shows each task, its status (succeeded/failed), and the exact timestamp. That single record answers most audit questions and spots tasks that failed silently — like a group removal that errored due to a permissions issue.
Which lifecycle workflow stage generates a Temporary Access Pass (TAP) for a new hire before their start date?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between an access review and a lifecycle workflow in Entra Identity Governance? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Entitlement management
- An Entra ID Governance feature that automates access request workflows, approvals, assignments, reviews, and expiration for groups, apps, and SharePoint sites.
- Access package
- A bundle of resource roles (group memberships, app roles, SharePoint sites) that a user requests as a single unit, governed by a policy defining approvers, duration, and reviews.
- Catalog
- A container of resources and access packages in entitlement management. Enables delegation: a catalog owner manages their packages without needing a global admin role.
- Separation of duties (SoD)
- An entitlement management rule that marks two access packages as incompatible, blocking a user from holding both simultaneously to prevent internal control violations.
- Access review
- A scheduled recertification cycle where a reviewer (owner, manager, or self) confirms or denies continued access to a group, app role, or Entra ID role. Auto-apply enforces decisions automatically.
- Lifecycle workflow
- An Entra ID Governance automation that runs tasks (add/remove groups, disable account, generate TAP) triggered by HR attributes for the joiner, mover, and leaver (JML) cycle.
- Joiner-Mover-Leaver (JML)
- The three key identity lifecycle events: Joiner (new hire provisioning), Mover (role or department change), and Leaver (termination and deprovisioning).
- Terms of use
- A PDF policy document attached to a Conditional Access policy. Users must accept the current version before accessing the targeted app; acceptance is logged with timestamp and IP.
- Temporary Access Pass (TAP)
- A time-limited passcode generated for a new user (joiner task) to enable first sign-in and MFA registration without a permanent password.
- Auto-apply results
- An access review setting that automatically enforces reviewer decisions — removing or confirming access — when the review period closes, without a manual admin step.
📚 Sources
- Microsoft Learn — What is Microsoft Entra Identity Governance?. learn.microsoft.com/en-us/entra/id-governance/identity-governance-overview
- Microsoft Learn — What is entitlement management? — access packages, catalogs, policies, SoD. learn.microsoft.com/en-us/entra/id-governance/entitlement-management-overview
- Microsoft Learn — What are access reviews? — scheduling, reviewer types, auto-apply. learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview
- Microsoft Learn — Understanding lifecycle workflows — JML triggers, tasks, workflow history. learn.microsoft.com/en-us/entra/id-governance/understanding-lifecycle-workflows
- Microsoft Learn — Plan a lifecycle workflow deployment — joiner, mover, leaver task catalog. learn.microsoft.com/en-us/entra/id-governance/lifecycle-workflows-deployment
- Microsoft Learn — Microsoft Entra ID Governance licensing fundamentals — P2 vs Governance add-on. learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals
What's next?
Got Governance? Next, go deep on Privileged Identity Management (PIM) — how just-in-time role activation, approval workflows, and access reviews combine to shrink your privileged attack surface.