entra-id-governance

Name: entra-id-governance
Author: vinayaklatthe

54installs34forks

How to install entra-id-governance?

vinayaklatthe/microsoft-security-skills/entra-id-governance

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-id-governance

Installs into the current project.

Summary

Guidance for Microsoft Entra ID Governance — automating identity lifecycle and access with entitlement management (access packages), access reviews, lifecycle workflows for joiner-mover-leaver, separation of duties, and guest access governance. Covers when to use access packages

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra ID Governance
2
3	Entra ID Governance ensures the **right identities have the right access to the right
4	resources at the right time**. It automates identity lifecycle (JML) and access governance for
5	employees, partners, and guests. Requires the Entra ID Governance SKU (P2 + Governance
6	add-on, or M365 E5 + Governance).
7
8	## When to use
9	Automating access requests/approvals, recurring access certification, and joiner-mover-leaver
10	provisioning. Use this skill to choose between access packages and direct group assignment,
11	configure access reviews safely, and run lifecycle workflows.
12
13	Do not use this skill for risk detection (`entra-id-protection`), Conditional Access
14	(`conditional-access-mfa`), or PIM activation (`azure-pim`).
15
16	## Pick the right governance mechanism
17
18	\| If the goal is... \| Use \| Notes \|
19	\|---\|---\|---\|
20	\| Self-service access request with approval \| Entitlement management - access package \| Includes guests; sponsor or manager approval \|
21	\| Time-bound access for a project \| Access package with expiration \| Auto-revokes; safer than group \|
22	\| Govern an existing privileged group \| PIM for Groups (separate skill) \| Just-in-time, not lifecycle \|
23	\| Recertify membership of a sensitive group \| Access review on the group \| Manager or self-attestation \|
24	\| Recertify access to an app \| Access review on app assignments \| Catches stale SaaS access \|
25	\| Auto-provision new joiners \| Lifecycle workflow - joiner \| Pre-hire setup, welcome email \|
26	\| Auto-revoke leaver access \| Lifecycle workflow - leaver \| Disable, group removal, license drop \|
27	\| Move to new department auto-adjust access \| Lifecycle workflow - mover + dynamic groups \| Attribute-driven \|
28	\| Catch toxic role combos (e.g. AP + AR) \| Separation of duties on access package \| Hard-block incompatible packages \|
29
30	> Rule of thumb: if humans request the access, use an access package. If the system grants
31	> the access from HR attributes, use lifecycle workflows + dynamic groups. Direct group
32	> assignment is the legacy default and rarely correct in 2026.
33
34	## Approach
35
36	1. Define the catalogue — Access packages live in a catalogue. Catalogues map to a
37	business owner (HR, Finance, Engineering platform team). Catalogue owners are accountable;
38	IT facilitates.
39	Verify: each catalogue has a named non-IT owner.
40
41	2. Build access packages with policies — Each package has resources (groups, apps,
42	SharePoint sites), eligible requesters (internal users, specific connected orgs, all
43	external), and an assignment policy (approval, expiration, attribute requirements).
44	Verify: every package has expiration set; no perpetual access.
45
46	3. Configure access reviews safely — Set reviewer (manager > self > specific user),
47	recurrence (quarterly Tier 0, bi-annually Tier 1, annually Tier 2). Critical: choose
48	"no response" action carefully - auto-remove on no response is safer for low-risk
49	resources but dangerous if the reviewer is on leave.
50	Verify: reviewer escalation enabled; "no response" defaults documented per review.
51
52	4. Lifecycle workflows for JML — Build three core flows: Pre-hire (T-7 days),
53	Joiner (start date), Leaver (last day). Use HR attributes as triggers (`employeeType`,
54	`employeeHireDate`, `accountEnabled`).
55	*Verify: leaver flow disables account, removes from all groups, revokes sessions, within
56	1 hour of HR attribute change.*
57
58	5. Separation of duties on access packages — Mark incompatible packages (e.g. "Accounts
59	Payable" + "Vendor Master Data Editor"). System blocks the second request with audit log.
60
61	6. Guest governance — All B2B guests via access packages with expiration. Run a quarterly
62	review of guests with no recent activity (use `signInActivity` filter). Remove inactive
63	guests automatically.
64	Verify: guests created outside an access package = 0 in monthly report.
65
66	## Guardrails
67	- **Prioritise leaver/deprovisioning automation - orphaned access is a common breach root
68	cause.** Leaver workflow with

People who liked this also viewed

6 picks

Type

entra-id-governance

54installs34forks

View on GitHub

How to install entra-id-governance?

vinayaklatthe/microsoft-security-skills/entra-id-governance

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill entra-id-governance

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Entra ID Governance
2
3	Entra ID Governance ensures the **right identities have the right access to the right
4	resources at the right time**. It automates identity lifecycle (JML) and access governance for
5	employees, partners, and guests. Requires the Entra ID Governance SKU (P2 + Governance
6	add-on, or M365 E5 + Governance).
7
8	## When to use
9	Automating access requests/approvals, recurring access certification, and joiner-mover-leaver
10	provisioning. Use this skill to choose between access packages and direct group assignment,
11	configure access reviews safely, and run lifecycle workflows.
12
13	Do not use this skill for risk detection (`entra-id-protection`), Conditional Access
14	(`conditional-access-mfa`), or PIM activation (`azure-pim`).
15
16	## Pick the right governance mechanism
17
18	\| If the goal is... \| Use \| Notes \|
19	\|---\|---\|---\|
20	\| Self-service access request with approval \| Entitlement management - access package \| Includes guests; sponsor or manager approval \|
21	\| Time-bound access for a project \| Access package with expiration \| Auto-revokes; safer than group \|
22	\| Govern an existing privileged group \| PIM for Groups (separate skill) \| Just-in-time, not lifecycle \|
23	\| Recertify membership of a sensitive group \| Access review on the group \| Manager or self-attestation \|
24	\| Recertify access to an app \| Access review on app assignments \| Catches stale SaaS access \|
25	\| Auto-provision new joiners \| Lifecycle workflow - joiner \| Pre-hire setup, welcome email \|
26	\| Auto-revoke leaver access \| Lifecycle workflow - leaver \| Disable, group removal, license drop \|
27	\| Move to new department auto-adjust access \| Lifecycle workflow - mover + dynamic groups \| Attribute-driven \|
28	\| Catch toxic role combos (e.g. AP + AR) \| Separation of duties on access package \| Hard-block incompatible packages \|
29
30	> Rule of thumb: if humans request the access, use an access package. If the system grants
31	> the access from HR attributes, use lifecycle workflows + dynamic groups. Direct group
32	> assignment is the legacy default and rarely correct in 2026.
33
34	## Approach
35
36	1. Define the catalogue — Access packages live in a catalogue. Catalogues map to a
37	business owner (HR, Finance, Engineering platform team). Catalogue owners are accountable;
38	IT facilitates.
39	Verify: each catalogue has a named non-IT owner.
40
41	2. Build access packages with policies — Each package has resources (groups, apps,
42	SharePoint sites), eligible requesters (internal users, specific connected orgs, all
43	external), and an assignment policy (approval, expiration, attribute requirements).
44	Verify: every package has expiration set; no perpetual access.
45
46	3. Configure access reviews safely — Set reviewer (manager > self > specific user),
47	recurrence (quarterly Tier 0, bi-annually Tier 1, annually Tier 2). Critical: choose
48	"no response" action carefully - auto-remove on no response is safer for low-risk
49	resources but dangerous if the reviewer is on leave.
50	Verify: reviewer escalation enabled; "no response" defaults documented per review.
51
52	4. Lifecycle workflows for JML — Build three core flows: Pre-hire (T-7 days),
53	Joiner (start date), Leaver (last day). Use HR attributes as triggers (`employeeType`,
54	`employeeHireDate`, `accountEnabled`).
55	*Verify: leaver flow disables account, removes from all groups, revokes sessions, within
56	1 hour of HR attribute change.*
57
58	5. Separation of duties on access packages — Mark incompatible packages (e.g. "Accounts
59	Payable" + "Vendor Master Data Editor"). System blocks the second request with audit log.
60
61	6. Guest governance — All B2B guests via access packages with expiration. Run a quarterly
62	review of guests with no recent activity (use `signInActivity` filter). Remove inactive
63	guests automatically.
64	Verify: guests created outside an access package = 0 in monthly report.
65
66	## Guardrails
67	- **Prioritise leaver/deprovisioning automation - orphaned access is a common breach root
68	cause.** Leaver workflow with

People who liked this also viewed

6 picks

Type