Topic 5 of 5
Identity governance and protection
Granting access is easy; removing it on time is the hard part. Here are the tools to govern the identity and access lifecycle, control privileged access, detect compromised identities, and verify credentials.
Contents
Microsoft Entra ID Governance
An identity governance solution that improves productivity, strengthens security, and makes it easier to meet regulatory requirements. It uses AI-driven insights to ensure the right people have the right access to the right resources, through automation, delegation to business teams, and visibility. It answers four questions, for on-premises and cloud access:
- Which identities should have access to which resources?
- What are they doing with that access?
- Are there organizational controls for managing it?
- Can auditors verify that the controls work?
It applies to employees, business partners, and vendors, and extends to agent identities: each one requires an accountable human sponsor, and if the sponsor leaves the organization, sponsorship automatically transfers to their manager.
The three lifecycles
Identity lifecycle
The join, move, leave model: the identity is created on joining, permissions are added or removed on moving, and access is removed on leaving. It's usually tied to the HR system (Workday, SuccessFactors) so the employee is productive from day one. It's automated with:
- Inbound provisioning from HR into Entra ID and AD
- Lifecycle workflows at key moments (before starting, on status change, on leaving)
- Automatic assignment policies based on user attributes
- User provisioning to hundreds of cloud and on-premises apps
Access lifecycle
Managing access beyond initial provisioning, at scale. Dynamic groups evaluate attribute-based rules and add or remove members when an attribute changes; entitlement management handles requests and separation of duties; access reviews recertify periodically.
Privileged access lifecycle
Admin rights for employees, vendors, and contractors need a governance process because of their potential for misuse. PIM handles this, minimizing how many people have privileged access across Entra, Azure, and other Microsoft online services.
Access reviews
They review group memberships, enterprise app access, and role assignments. Excessive access rights are a known risk, and when people change teams or responsibilities they're hard to control. Use cases:
Too many privileged users
Find admins or guests who should no longer hold a role. Entra or Azure roles are recertified from PIM.
Critical data
Ask people to periodically reconfirm and justify their access, as part of compliance.
Policy exceptions
Show auditors that exceptions are reviewed regularly.
Guests in groups
Have group owners confirm whether guests still have a legitimate business need.
- Reviewers: the users themselves (self-review) or a decision maker, such as the group owner or manager.
- Recurrence: weekly, monthly, quarterly, or annually. Reviewers are notified at the start.
- Multi-stage: up to three stages with different reviewers in sequence, for complex audit requirements.
- AI recommendations: based on sign-in activity and group affiliation; users who are outliers compared to their peers deserve extra scrutiny.
- Outcome: no access changes until the review finishes (it can be stopped early). Changes are applied manually or automatically, except for dynamic groups or groups that originate on-premises, which are changed directly in the group.
Entitlement management
It manages the identity and access lifecycle at scale: it automates request workflows, assignments, reviews, and expiration. It solves three common problems:
- Users don't know what access to request or from whom
- Once they have it, they keep it longer than needed
- Nobody manages external users' access consistently
Access package
A bundle of all the resources, with their access level, that someone needs for a project or task: security groups, Microsoft 365 groups, enterprise apps, and SharePoint Online sites.
Delegation
Packages are created by non-admins, who define who can request, who approves, and when it expires.
External users
An approved outsider is automatically invited to the directory. When their access expires and they have no other packages, their B2B account can be removed automatically.
AI agents
It also governs agent identities' access; sponsors ensure it lasts only as long as needed.
Terms of use
They present information to users before they access data or an app, so they read legal or compliance disclaimers. They're shown in PDF format with your own content (for example, an existing contract), also on mobile.
- Before accessing sensitive data or an application
- On a recurring schedule, as a reminder of regulations
- Based on user attributes, such as terms for certain roles
- For every user in the organization
They're required through Conditional Access policies, and admins can see who accepted and who declined.
Privileged Identity Management (PIM)
It manages, controls, and monitors access to important resources in Entra ID, Azure, and other online services like Microsoft 365 or Intune. It provides time-based and approval-based role activation, requires justification, and enforces MFA to activate any role. It reduces the chance an attacker gets access and the risk of an authorized user accidentally affecting sensitive resources.
Just-in-time
Access only when needed
Time-bound
Start and end dates
Approval-based
Approval to activate
Visible
Notifications on activation
Auditable
Downloadable full history
Entra roles
Also called directory roles, built-in and custom.
Azure roles
RBAC roles on management groups, subscriptions, resource groups, and resources.
PIM for Groups
Just-in-time membership and ownership of a group, which in turn can grant roles or access to SQL, Key Vault, Intune, or other apps.
Assign
Roles are assigned to users, groups, service principals, or managed identities, with members, scope, type (eligible or active), and duration (dates or permanent).
Activate
An eligible user activates the role, choosing a duration within the configured maximum and a reason.
Approve or deny
Delegated approvers get an email and decide in PIM.
Extend or renew
Request an extension before it expires or a renewal if it already expired.
Eligible assignment
The member has to do something to use the role: activate it or request approval.
Active assignment
The member has the privileges without doing anything.
The PIM audit history shows assignments and activations from the past 30 days. If the license expires, eligible Entra role assignments are removed and permanent ones are kept.
Microsoft Entra ID Protection
It detects, investigates, and remediates identity-based risks, for users and workload identities. Its risks feed Conditional Access or a SIEM. It analyzes trillions of daily signals from Entra ID, Microsoft accounts, and Xbox. Requires P2.
Sign-in risk
The probability that an authentication request isn't made by the identity's owner. Real-time detections run at every sign-in. Examples: anonymous IP, atypical travel (two sign-ins from very distant places), unfamiliar sign-in properties.
User risk
The probability that the identity or account is compromised. Examples: leaked credentials, user-reported suspicious activity, suspicious sending patterns.
Detections are only generated when correct credentials are used: if someone types a wrong password, there's no risk of credential compromise.
Detect
Risk detections; real-time ones run at every sign-in.
Investigate
Three reports: risk detections, risky sign-ins (with one or more detections), and risky users (with risky sign-ins or detections).
Remediate
Risk-based Conditional Access requires a strong method, MFA, or a secure password change; if the user completes it, the risk is remediated automatically. Without automation, the admin dismisses, confirms safe, or confirms compromised from the portal, the API, or Defender XDR.
Export
Microsoft Graph APIs, a Log Analytics workspace, a storage account, Event Hubs, or a SIEM.
Microsoft Entra Verified ID
A managed verifiable credentials service based on open standards (Microsoft works with the W3C and the Decentralized Identity Foundation). Today it's hard to present a digital credential that's secure, privacy-compliant, and machine-readable, and to control what happens to your data once shared. Verifiable credentials solve that and put people in control of their identity.
Issuer
Attests to claims and issues signed credentials: an identity verification provider, a government, an employer, a university.
User
Receives and approves credentials, stores them in their digital wallet, and presents them. Claims are signed with their private key.
Verifier
Requests proof and checks that it meets its requirements: a prospective employer, an airline, a mortgage company.
- Behind it is a verifiable data registry (metadata such as public keys) that the verifier reads. Verified ID uses the did:web trust system: the issuer's decentralized identifier is linked to a web domain it controls, and trust comes from that domain's reputation.
- Credentials can expire or the issuer can revoke them; the standard includes fields for that.
- Account recovery: a verification provider validates the government ID, a credential is issued to Authenticator, Face Check compares a selfie with the photo, and the user gets a TAP to re-register methods.
- Against deepfakes and AI-driven impersonation, it helps confirm you're interacting with real, verified people.
Security Copilot in Entra
Microsoft Security Copilot uses the Entra plugin to investigate identity risks in natural language over users, groups, and sign-in and audit logs, find gaps in access policies, and generate identity workflows.
Standalone experience
In the Security Copilot portal, with prompts like "list the recent risky sign-ins for this user" or "get their audit logs for the past 72 hours".
Embedded experience
Inside the Entra admin center; for example, the risky users report summarizes a user's risk and recommends how to mitigate it.
It covers Entra ID, ID Protection, ID Governance (reviews, access packages, PIM, lifecycle workflows), and Internet and Private Access. Entra agents, each with its own agent identity:
- Conditional Access Optimization Agent: reviews policies every 24 hours (or on demand) against best practices and Zero Trust and finds unprotected users, apps, and agent identities.
- Identity Risk Management Agent (preview): helps investigate and act on ID Protection risks.
Which license each feature needs
| Feature | License |
|---|---|
| PIM and PIM for Groups | P2 or ID Governance |
| Core access reviews and entitlement management | P2 or ID Governance |
| Lifecycle workflows, machine learning-assisted reviews, automatic assignment | ID Governance |
| Terms of use with Conditional Access | P1 |
| ID Protection and risk-based policies | P2 |
| Core Verified ID | Included with any Entra subscription, including Free |
| Verified ID Face Check | Add-on; included in Entra Suite |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| An admin needs Global Administrator only when they ask for it and with approval | PIM with an eligible assignment | Just-in-time activation with approval and justification. |
| Check every quarter whether a group's guests are still needed | Recurring access review | Group owners recertify access. |
| A new hire must request a group, an app, and a site in one step | Access package | Entitlement management bundles resources. |
| Create an employee's account before their first day from the HR system | Inbound provisioning + lifecycle workflows | It automates the join in join-move-leave. |
| A user's credentials show up leaked on the internet | User risk (ID Protection) | It indicates the account is probably compromised. |
| A sign-in from an anonymous IP | Sign-in risk | It affects that specific request. |
| A university issues digitally verifiable diplomas | Verified ID | Verifiable credentials with issuer, user, and verifier. |
| Require users to accept a legal notice before opening an app | Terms of use in Conditional Access | They're required as a grant control. |
Common exam traps
❓ An admin should get Global Administrator only when needed and with approval. Which tool?
PIM, with an eligible assignment that requires activation and approval. Access reviews recertify access but don't provide just-in-time access.
❓ A user's credentials show up on the dark web. Sign-in risk or user risk?
User risk: it indicates the account is compromised. Anonymous IP or atypical travel are sign-in risk.
❓ Does a wrong password generate an ID Protection detection?
No. Detections are only generated when correct credentials are used.
❓ During an access review, are permissions removed as they're reviewed?
No. No access changes until the review finishes.
❓ How many days does PIM's audit history cover?
The past 30 days of assignments and activations.
❓ How do you force users to accept terms of use before opening an app?
With a Conditional Access policy that requires terms of use as a grant control.
❓ Does Verified ID require a premium license?
No. It's included with any Entra subscription, including Free; Face Check is an add-on.
❓ Do lifecycle workflows come with P2?
No. They require Microsoft Entra ID Governance.
Did you get this topic?
Test what you just learned
A university issues digital diplomas that an employer can verify cryptographically without contacting the university. Which service makes this possible?
Ready to test "Governance, PIM, and ID Protection"?
Original questions, each with a full explanation.
Start a mock exam