Identity governance and the JML lifecycle
Who should have access, who decided, and is it still right today?
IAM with governance built in
IDAM (identity and access management) is the term most UK public sector and defence organisations use for the discipline the rest of the industry calls IAM. In practice, IDAM programmes usually put extra weight on identity governance and administration (IGA): controlling the full life of an identity and proving its access was appropriate at every point.
Good governance answers four questions at any time, with evidence:
- Who has access to what?
- Who approved it, and why?
- Is it still needed?
- How fast is it removed when it is not?
The HR system is the single source of truth for people. It knows who has started, changed role or left before IT does. Microsoft Entra supports inbound provisioning from HR systems, so a new starter record can create the account automatically and a leaving date can trigger offboarding.
Joiner Day one
- Trigger
- New starter record in HR
- Entra features
- HR inbound provisioning, dynamic groups, Lifecycle Workflows joiner templates, Temporary Access Pass
- Common failure
- Access copied from a colleague ("make them like Sam"), bringing every one of Sam's exceptions with it
Mover Role change
- Trigger
- Department, job title or manager changes in HR
- Entra features
- Dynamic groups recalculate, access packages with expiry, a targeted access review after the move
- Common failure
- New access is added but old access is never removed. Long-serving staff end up with the most access.
Leaver Last day
- Trigger
- Leaving date reached, or an immediate termination
- Entra features
- Lifecycle Workflows leaver templates, session revocation, licence removal, Lab 06 style automation
- Common failure
- The account is disabled but refresh tokens stay valid, or shared secrets the person knew are never rotated
Disabling is not the same as removing access
A disabled account cannot sign in again, but sessions and tokens issued before the change can stay usable for a while. A complete leaver process does all of the following, in this order.
# Leaver essentials with Microsoft Graph PowerShell (lab tenant only)
$u = Get-MgUser -UserId 'leaver@contoso.example'
Update-MgUser -UserId $u.Id -AccountEnabled:$false # 1. stop new sign-ins
Revoke-MgUserSignInSession -UserId $u.Id # 2. invalidate refresh tokens
# 3. remove group memberships and licences
# 4. transfer mailbox, OneDrive and app ownership to the manager
# 5. rotate any shared or service credentials the person knewWhen someone is dismissed, do steps 1 and 2 before the conversation ends, not after. Lifecycle Workflows has a real-time termination template for exactly this case.
Access packages and access reviews
Not everything can be granted by attribute. For everything else, use access packages in Entra Entitlement Management: a bundle of groups, apps and sites that a user requests, a named approver signs off, and that expires automatically. Packages can be marked as incompatible with each other, which enforces separation of duties at request time.
Access reviews then ask a person (the user's manager, the resource owner, or the user themselves) to confirm on a schedule that access is still needed. Set reviews to apply results automatically, and decide deliberately what happens if the reviewer does not respond. Lab 08 builds both.
| Measure | Why it matters | Healthy target |
|---|---|---|
| Time to deprovision | How long a leaver keeps access | Same working day, immediate for hostile leavers |
| Dormant enabled accounts | Unwatched footholds | Trending towards zero |
| Review completion rate | Whether certification actually happens | Close to 100 per cent, on time |
| Guests with no recent sign-in | External access nobody is using | Removed by review each quarter |
| Separation of duties conflicts | Toxic combinations of roles | Zero, or each one formally accepted |
Privileged Identity Management
Admin rights that exist only while they are being used, with a reason and a record.
Eligible, not active
Microsoft Entra Privileged Identity Management (PIM) separates being allowed to hold a role from holding it. An administrator is made eligible for a role. When they need it, they activate it for a limited time, meeting whatever conditions the role requires. When the time runs out, the privilege disappears automatically.
Holds the role around the clock. Only break-glass accounts should look like this.
Holds the role for a fixed period, for example a three-day project, then loses it.
Holds nothing until they activate, with MFA, a reason and optional approval.
Settings you will configure
| Setting | What it controls | Sensible starting point |
|---|---|---|
| Maximum activation duration | How long one activation lasts | Up to 8 hours; shorter for Global Administrator |
| Require MFA on activation | Strong proof at the moment privilege is granted | On, ideally with a phishing-resistant authentication context |
| Require justification | A recorded reason for each activation | On for every role |
| Require approval | A second person signs off | On for Global Administrator and Privileged Role Administrator |
| Assignment expiry | Whether eligibility itself ends | Expire, or recertify through access reviews |
| Notifications | Who is told about activations | Security team for every activation of a top-tier role |
PIM works for Microsoft Entra roles, Azure resource roles (such as Owner on a subscription) and PIM for Groups, where membership of a group is made just in time. Users who benefit from PIM need Microsoft Entra ID P2 or Microsoft Entra ID Governance licensing.
How much exposure does just-in-time remove?
Standing privilege is available to an attacker every hour of the year. With PIM, it is only available during activations. Move the sliders to match your environment.
Standing figure assumes 8,760 hours a year per admin. JIT figure assumes 52 working weeks. It is an illustration, not a risk score.
Five mistakes that undo PIM
- Putting break-glass accounts behind PIMEmergency accounts must stay permanently active so they work when PIM, MFA or approvers are unavailable.
- Removing standing access before eligibility worksMake people eligible and test an activation first. Availability before removal.
- Eligible foreverEligibility nobody reviews quietly becomes standing access by another name. Recertify it (Lab 08).
- Long maximum durationsA 24-hour window for Global Administrator is close to standing privilege.
- Forgetting role-targeted Conditional AccessPolicies that target directory roles apply only while the role is active, so admins between activations fall outside them. Lab 07 explains the effect.