Identity Governance is about ensuring the right people have the right access to the right resources at the right time—and can prove it. This lab covers the complete identity lifecycle from onboarding (Joiner) through role changes (Mover) to offboarding (Leaver), plus entitlement management for self-service access requests, B2B collaboration for external partners, and workload identities for applications and automation. These capabilities transform Entra ID from an authentication service into a complete Identity Governance and Administration (IGA) platform.
Identity Governance answers the questions that keep CISOs up at night: Who has access to what? Why do they have it? When should it be removed? Can we prove compliance? Entra ID Governance provides the tools to automate the identity lifecycle, enable self-service access requests with approvals, conduct periodic access reviews, and manage external collaboration—all while maintaining an audit trail for compliance.
Prerequisites
LAB 8 Completed: Entra ID tenant with users, groups, apps, and PIM
Entra ID P2 License: Required for Entitlement Management and Lifecycle Workflows
Azure Subscription: For Managed Identity exercises
Global Administrator or Identity Governance Administrator: Role required
What You Will Build
Access Catalog: Organized collection of resources users can request
Access Packages: Bundles of group memberships, app access, and roles
Lifecycle Workflows: Automated tasks for Joiner/Mover/Leaver scenarios
Access Reviews: Periodic certification of who has access to what
B2B Portal: Self-service guest invitation with policies
Managed Identities: Passwordless authentication for Azure resources
Workload Identity Federation: Keyless auth for GitHub Actions/Kubernetes
Learning Objectives
Design and implement entitlement management with catalogs and access packages
Configure multi-stage approval workflows for access requests
Automate identity lifecycle with Joiner/Mover/Leaver workflows
Implement access reviews for compliance and certification
Manage B2B collaboration with external identity policies
Deploy managed identities for Azure workloads
Configure workload identity federation for CI/CD pipelines
Enterprise Scenario: Governance Transformation at GlobalTech
You're the Identity Governance Lead at GlobalTech, and the CISO has mandated a governance overhaul after an audit finding:
"Our auditors found 340 orphaned accounts, 50+ users with access they no longer need, and no process for reviewing who has access to sensitive systems. We're also onboarding a major consulting firm—200 external users who need limited access. And our DevOps team is tired of managing service account passwords. Fix this with proper governance."
Automate provisioning/deprovisioning to eliminate orphaned accounts
Self-service access requests with approval workflows
Quarterly access reviews for all sensitive applications
B2B collaboration with controlled external access
Eliminate service account passwords with managed identities
Skills You Will Gain
Entitlement Management
Create self-service access catalogs with approval workflows.
Lifecycle Automation
Automate onboarding, transfers, and offboarding.
Access Certification
Implement recurring access reviews for compliance.
B2B Governance
Control external collaboration with policies.
Managed Identities
Eliminate passwords for Azure workloads.
Workload Federation
Keyless authentication for CI/CD and Kubernetes.
Identity Governance Architecture
Identity Governance in Entra ID consists of several interconnected components that work together to manage the complete identity lifecycle and access management process.
The Identity Lifecycle
Every identity goes through a lifecycle with distinct phases:
Build a self-service access request system with organized resource catalogs.
60-90 minutes7 stepsEntra Portal
Entitlement Management enables self-service access requests with governance. Instead of IT manually processing access requests, users browse a catalog, request what they need, approvals happen automatically, and access expires when no longer needed. This reduces IT overhead while maintaining control.
1
Access Identity Governance
Entra Portal
Navigate to: https://entra.microsoft.com
Identity governance (left menu)
Identity Governance sections:
- Entitlement management: Access packages and catalogs
- Access reviews: Periodic certification
- Lifecycle workflows: Joiner/Mover/Leaver automation
- Terms of use: Compliance agreements
Click "Entitlement management" to begin
2
Create a Catalog
Catalogs organize access packages by department, project, or business unit.
Entra Portal
Navigate to: Identity governance Entitlement management Catalogs
Click "New catalog"
Create Engineering Catalog:
- Name: Engineering Resources
- Description: Access packages for engineering team resources
- Enabled: Yes
- Enabled for external users: No (for now)
Click "Create"
Create HR Catalog:
Click "New catalog"
- Name: HR Resources
- Description: Access packages for HR systems and data
- Enabled: Yes
- Enabled for external users: No
Click "Create"
Catalogs allow delegated administration:
- Engineering manager owns Engineering catalog
- HR director owns HR catalog
3
Add Resources to Catalog
Entra Portal
Navigate to: Catalogs Engineering Resources Resources
Click "Add resources"
Add Groups:
Select "Groups and Teams"
Search and select: SG-Engineering (from LAB 8)
Click "Add"
Add Applications:
Click "Add resources" again
Select "Applications"
Search and select: Your test applications
Click "Add"
(Optional) Add SharePoint Sites:
Select "SharePoint sites"
Select relevant sites
Resources in catalog:
- SG-Engineering (Security Group)
- TechStart Internal Portal (Application)
- [Any other resources you have]
These resources can now be bundled into access packages.
4
Create an Access Package
Entra Portal
Navigate to: Identity governance Entitlement management Access packages
Click "New access package"
Basics:
- Name: Engineering Team Access
- Description: Standard access for engineering team members
- Catalog: Engineering Resources
Click "Next: Resource roles"
Resource roles:
Click "Groups and Teams"
Select: SG-Engineering
Role: Member
Click "Select"
Click "Applications"
Select: TechStart Internal Portal
Role: User (or appropriate app role)
Click "Select"
Click "Next: Requests"
5
Configure Request Policy
Entra Portal
Requests tab - Who can request:
Users who can request access:
Select "For users in your directory"
Which users?
Select "Specific users and groups"
Add: All Users (or specific groups who can request)
Require approval:
Toggle: Yes
First approval:
- Approver: Manager as approver (auto-routes to manager)
OR Specific approver: Select engineering managers
- Decision must be made in: 14 days
- Require approver justification: Yes
Enable second approval stage (optional):
Toggle: Yes (for sensitive resources)
- Second approver: IT Security team
- Days for decision: 7
Require requestor justification: Yes
Click "Next: Requestor information"
6
Configure Request Questions
Entra Portal
Requestor information tab:
Add questions the requestor must answer:
Click "Add question"
Question 1:
- Question: What project requires this access?
- Answer format: Short text
- Required: Yes
Click "Save"
Click "Add question"
Question 2:
- Question: How long do you need this access?
- Answer format: Multiple choice
- Choices: 30 days, 90 days, 180 days, 1 year
- Required: Yes
Click "Save"
Click "Add question"
Question 3:
- Question: Manager approval confirmation
- Answer format: Long text
- Required: No
Click "Save"
Click "Next: Lifecycle"
7
Configure Lifecycle Settings
Entra Portal
Lifecycle tab:
Expiration:
- Access package assignments expire: Yes
- Assignments expire after: 180 days
(Or: On specific date, Never)
Users can request specific timeline: Yes
- Allow users to choose: 30-365 days
Access reviews:
- Require access reviews: Yes
- Starting on: [Select date]
- Review frequency: Quarterly
- Duration (days): 14
- Reviewers: Manager
- If reviewers don't respond: Remove access
Click "Next: Rules" (skip for now)
Click "Next: Review + create"
Review all settings and click "Create"
Access package is now live!
Module 1 Complete!
You've created an access catalog and your first access package. In Module 2, we'll test the request workflow.
Module 2: Access Package Policies & Approvals
Module 2: Test Access Requests and Multi-Stage Approvals
Experience the end-user request flow and approver workflow.
45-60 minutes5 stepsEntra Portal + My Access
The My Access portal (myaccess.microsoft.com) is where users discover and request access packages. Understanding both the requestor and approver experience is essential for designing effective governance workflows.
8
Access My Access Portal (User Experience)
Experience the access request flow as an end user.
Web Browser
Sign out of admin account.
Sign in as a test user (alice@yourdomain.onmicrosoft.com)
Navigate to: https://myaccess.microsoft.com
My Access Portal shows:
- Access packages: Available packages user can request
- Request history: Past requests and their status
- Approvals: Requests waiting for user's approval (if approver)
Click "Access packages" tab
Browse available packages
Find "Engineering Team Access"
Click "Request access"
9
Submit Access Request
Web Browser
Access Request Form:
Business justification:
"I need access to engineering resources for Project Alpha development"
Answer required questions:
1. What project requires this access?
"Project Alpha - Q1 Feature Development"
2. How long do you need this access?
Select: "180 days"
3. Manager approval confirmation (optional):
"Discussed with Bob Smith on 1/10"
Click "Submit"
Request submitted!
- Status: Pending approval
- Request ID: Generated automatically
- User receives email confirmation
Navigate to "Request history" to see pending request
10
Approve Request (Approver Experience)
Entra Portal
Sign out and sign in as the approver (manager or designated approver)
Option 1 - Via Email:
- Approver receives email with request details
- Click "Approve or deny" link in email
- Redirects to approval page
Option 2 - Via My Access Portal:
Navigate to: https://myaccess.microsoft.com
Click "Approvals" tab
Find pending request from Alice
Option 3 - Via Entra Portal:
Navigate to: Identity governance Entitlement management Requests
Filter: Pending approval
Select Alice's request
Review request:
- Requestor: alice@...
- Access package: Engineering Team Access
- Justification: [User's justification]
- Answers to questions: [Visible]
- Duration requested: 180 days
Click "Approve" (or "Deny")
Add approval justification: "Approved for Project Alpha"
Confirm
11
Verify Access Provisioned
Entra Portal
After approval, access is automatically provisioned:
Verify group membership:
Navigate to: Identity Groups SG-Engineering Members
Alice should now be listed as a member
Verify app assignment:
Navigate to: Applications Enterprise applications TechStart Portal
Users and groups
Alice should now be assigned
Check assignment in entitlement management:
Navigate to: Identity governance Entitlement management Access packages
Engineering Team Access Assignments
Alice listed with:
- Status: Delivered
- Expiration date: 180 days from now
- Assignment source: Self-requested
12
Create Policy for External Users
Add a separate policy allowing external (B2B) users to request access.
Entra Portal
Navigate to: Access packages Engineering Team Access Policies
Click "Add policy"
Create external user policy:
- Policy name: External Contractor Access
Users who can request:
Select "For users not in your directory"
Specific connected organizations (or All configured)
Request settings:
- Require approval: Yes
- First approver: Sponsor (internal user who invited them)
- Second approver: Security team
- Require MFA to request: Yes
Lifecycle:
- Expire after: 90 days (shorter for external)
- Access reviews: Monthly
Click "Create"
Now external users can request this package
(after being invited as guests)
Module 2 Complete!
You've experienced the complete access request lifecycle. In Module 3, we'll automate identity lifecycle events.
Create workflows that trigger automatically on hire, transfer, and termination.
60-90 minutes6 stepsEntra Portal
Lifecycle Workflows automate tasks based on identity events. When HR marks an employee's start date, a workflow can automatically create accounts, assign baseline access, send welcome emails, and notify managers—all without IT intervention. Similarly, when someone leaves, workflows can disable accounts, revoke access, and trigger offboarding tasks.
Lifecycle Workflow Triggers
Workflows can trigger based on:
User employeeHireDate: X days before/after hire date
User employeeLeaveDateTime: X days before/after leave date
Attribute change: When department, title, or other attribute changes
Group membership change: When added/removed from specific groups
On-demand: Manually triggered for testing or exceptions
13
Create Joiner Workflow
Entra Portal
Navigate to: Identity governance Lifecycle workflows Workflows
Click "New workflow"
Select template:
Choose "Onboard new hire employee" (or start from blank)
Configure basics:
- Display name: New Employee Onboarding
- Description: Automated onboarding for new hires
Click "Next: Configure scope"
Scope - Trigger details:
- Trigger type: Attribute changes
OR: Time-based (days from employeeHireDate)
- Days from event: 0 (on hire date)
OR: -7 (7 days before start)
Scope - User scope:
- Rule: Who this workflow runs for
- Scope type: Rule-based
- Property: department
- Operator: equals
- Value: Engineering
(Or use: All users, specific group, etc.)
Click "Next: Review tasks"
14
Configure Joiner Tasks
Entra Portal
Tasks define what happens when workflow triggers:
Click "Add task"
Task 1: Enable user account
- Category: User management
- Task: Enable user account
- This enables the account if pre-created disabled
Click "Add task"
Task 2: Add user to group
- Category: User management
- Task: Add user to group
- Group: SG-All-Employees-Dynamic (or static group)
Click "Add task"
Task 3: Send welcome email
- Category: Communication
- Task: Send email
- Email template: Welcome to the team!
- CC: Manager (dynamic)
- Subject: Welcome to GlobalTech!
- Body: Custom welcome message with links to resources
Click "Add task"
Task 4: Generate TAP (Temporary Access Pass)
- Category: User management
- Task: Generate Temporary Access Pass
- Lifetime: 24 hours
- One-time use: Yes
(Allows passwordless first sign-in)
Click "Next: Review + create"
Review and click "Create"
15
Create Leaver Workflow
Entra Portal
Navigate to: Lifecycle workflows Workflows
Click "New workflow"
Select template:
Choose "Offboard an employee" (or blank)
Basics:
- Display name: Employee Offboarding
- Description: Automated offboarding for departing employees
Trigger:
- Type: Time-based
- Attribute: employeeLeaveDateTime
- Days from event: 0 (on last day)
Scope:
- All users with employeeLeaveDateTime set
OR: Specific departments/groups
Tasks:
Click "Add task"
Task 1: Disable user account
- Task: Disable user account
Task 2: Remove all group memberships
- Task: Remove user from all groups
Task 3: Revoke all access package assignments
- Task: Remove access package assignment for user
- Scope: All packages
Task 4: Remove all app role assignments
- Task: Remove all app role assignments
Task 5: Send offboarding notification
- Task: Send email to manager
- Subject: Employee offboarding complete
- Include: List of access revoked
Click "Create"
16
Create Mover Workflow
Entra Portal
Navigate to: Lifecycle workflows Workflows
Click "New workflow"
Basics:
- Display name: Department Transfer Handler
- Description: Handles access changes when employee changes department
Trigger:
- Type: Attribute changes
- Attribute: department
- Change type: Modified
Tasks:
Task 1: Trigger access review
- Task: Request user access review
- Reviewer: New manager
- Duration: 7 days
- Message: "Please review this user's access after department transfer"
Task 2: Send notification
- Task: Send email
- To: User and new manager
- Subject: Department transfer - access review required
- Body: Instructions for reviewing and updating access
Task 3: Remove from old department group (optional)
- Task: Remove from group
- Group: Dynamic based on old department value
(May need custom logic or manual step)
Click "Create"
Note: Mover workflows often require custom tasks
or Logic Apps integration for complex scenarios.
17
Enable and Test Workflows
Entra Portal
Enable workflows:
Navigate to: Each workflow Properties
Toggle "Enable workflow" to Yes
Test workflow on-demand:
Navigate to: Lifecycle workflows Workflows [Workflow name]
Click "Run on demand"
Select test user(s)
Click "Run workflow"
Monitor execution:
Click "Workflow history"
View execution status for each user
Expand to see task-level results
Task statuses:
- Completed: Task executed successfully
- Failed: Task encountered error (view details)
- Skipped: Task not applicable (condition not met)
Review audit logs:
Navigate to: Identity governance Lifecycle workflows Audit logs
View all workflow executions and results
18
Configure Custom Tasks (Advanced)
Entra Portal
Custom tasks extend workflows with external actions:
Navigate to: Lifecycle workflows Custom task extensions
Click "Add custom task extension"
Custom task options:
1. Azure Logic App:
- Call Logic App for complex orchestration
- Example: Create ticket in ServiceNow
- Example: Provision accounts in non-Azure systems
2. Azure Function:
- Run serverless code
- Example: Custom notification formatting
- Example: Integration with HRIS
Configuration:
- Name: Create ServiceNow Ticket
- Type: Logic App
- Logic App: Select from subscription
- Callback enabled: Yes (wait for completion)
Use custom task in workflow:
Edit workflow Add task
Select custom task extension
Configure parameters
This enables integration with ANY external system!
Module 3 Complete!
You've automated the identity lifecycle with Joiner/Mover/Leaver workflows. Module 4 covers access reviews.
Module 4: Access Reviews Configuration
Module 4: Implement Periodic Access Certification
Create recurring reviews to certify who should retain access.
45-60 minutes5 stepsEntra Portal
Access reviews are the cornerstone of access governance. They ensure that access granted today is still appropriate tomorrow. Reviewers (managers, resource owners, or users themselves) periodically certify continued need. Reviews can auto-revoke access if not approved, ensuring least privilege is maintained over time.
19
Create Group Membership Review
Entra Portal
Navigate to: Identity governance Access reviews
Click "New access review"
Review type:
Select "Teams + Groups"
Review scope:
Select specific groups: SG-Engineering, SG-Finance
(Or "All Microsoft 365 groups with guest users")
Scope settings:
- Guest users only: No (review all members)
- OR: Yes (focus on external users)
Click "Next: Reviews"
Reviews settings:
- Review name: Quarterly Group Membership Review
- Start date: [Select]
- Frequency: Quarterly
- Duration: 14 days
- End: Never (ongoing)
Reviewers:
Select: "Group owners" (distributed review)
OR: "Manager of users" (manager reviews their reports)
OR: "Selected users" (specific reviewers)
Click "Next: Settings"
20
Configure Review Settings
Entra Portal
Settings tab:
Upon completion:
- Auto apply results to resource: Yes
(Automatically removes denied access)
- If reviewers don't respond: Remove access
(Or: No change, Approve, etc.)
Enable decision helpers:
- No sign-in within 30 days: Yes
(Highlights inactive users)
- User-to-group affiliation: Yes
(Shows if user still in org unit)
Advanced settings:
- Justification required: Yes
- Email notifications: Yes
- Reminders: Yes
- Additional content for reviewer email:
"Please review all members and deny access for
those who no longer require it."
Click "Next: Review + create"
Click "Create"
Access review series is now scheduled!
21
Create Application Access Review
Entra Portal
Navigate to: Identity governance Access reviews
Click "New access review"
Review type:
Select "Applications"
Scope:
Select: TechStart Internal Portal
(and other sensitive applications)
Reviewers:
Manager of users (each manager reviews their reports)
OR: Application owners
Review settings:
- Name: Quarterly Application Access Review
- Frequency: Quarterly
- Duration: 14 days
Upon completion:
- Auto apply: Yes
- No response action: Remove access
Enable decision helpers:
- Show no sign-in in 90 days: Yes
(User hasn't used the app)
Click "Create"
Application access is now subject to quarterly review!
22
Perform Access Review (Reviewer Experience)
Web Browser
Reviewer receives email notification when review starts.
Sign in as reviewer (manager or group owner)
Navigate to: https://myaccess.microsoft.com
Click "Access reviews" tab
Pending reviews show:
- Review name: Quarterly Group Membership Review
- Due date: [Date]
- Progress: 0/5 reviewed
Click to open review:
For each user listed:
- User name and details
- Decision helpers:
"No sign-in in 30 days"
✓ "Active in organization"
Actions per user:
- Approve: User retains access
- Deny: User loses access (if auto-apply on)
- Don't know: Escalate to another reviewer
- Justification: Required text field
Bulk actions:
- Select multiple Approve/Deny all
After reviewing all users:
- Submit review
- Results applied based on settings
23
Review Access Review Results
Entra Portal
Navigate to: Identity governance Access reviews [Review name]
Results tab shows:
- Total users reviewed: X
- Approved: X
- Denied: X
- Not reviewed: X
- Auto-applied: X
Reviewers tab:
- Reviewer completion status
- Send reminder to incomplete reviewers
History:
- Past review cycles and their results
- Trend of approvals vs denials
Export:
Click "Download"
Export CSV for compliance documentation
Audit logs:
Navigate to: Identity governance Access reviews Audit logs
View all review decisions for compliance
Module 4 Complete!
You've implemented access reviews for groups and applications. Module 5 covers B2B collaboration.
Module 5: B2B Collaboration & Guest Management
Module 5: Manage External Identities and Partner Access
Configure B2B collaboration for secure external user access.
45-60 minutes5 stepsEntra Portal
B2B (Business-to-Business) collaboration allows you to invite external users—partners, vendors, contractors—as "guests" in your tenant. Guests authenticate with their home organization (or Microsoft/Google account) and access resources you've shared. Proper governance ensures guests don't overstay their welcome or access more than intended.
24
Configure External Collaboration Settings
Entra Portal
Navigate to: Identity External Identities External collaboration settings
Guest user access restrictions:
Select: "Guest users have limited access to properties
and memberships of directory objects" (recommended)
Guest invite restrictions:
Select who can invite guests:
- "Only users assigned to specific admin roles can invite"
(Most restrictive - recommended for governance)
- "Member users and users assigned to specific admin roles"
- "Anyone in the organization can invite guest users"
Enable guest self-service sign-up:
No (for controlled invitation process)
Collaboration restrictions:
Select: "Allow invitations only to specified domains"
Add allowed domains:
- partner1.com
- consultingfirm.com
- vendor.org
OR: "Deny invitations to specified domains"
Block known risky or personal domains
Click "Save"
25
Create Connected Organization
Connected organizations represent trusted partners for entitlement management.
Entra Portal
Navigate to: Identity governance Entitlement management Connected organizations
Click "Add connected organization"
Basics:
- Name: Acme Consulting
- Description: External consulting firm for Project Alpha
- State: Configured
Directory + domain:
Click "Add directory or domain"
- Type: Domain
- Domain name: acmeconsulting.com
Click "Add"
(If partner has Entra ID tenant):
- Type: Azure AD tenant
- Tenant ID: [Partner's tenant ID]
Sponsors (internal users who manage this relationship):
Add: Bob Smith (Project Manager)
Add: IT Admin
Click "Create"
Connected organization users can now:
- Request access packages enabled for external users
- Be identified as "Acme Consulting" in the system
26
Invite Guest Users
Entra Portal
Navigate to: Identity Users All users
Click "New user" "Invite external user"
Invite guest:
- Email: contractor@acmeconsulting.com
- Display name: External Consultant
- Personal message: "Welcome to GlobalTech project collaboration"
Send invite:
Click "Invite"
Guest receives email:
- Link to accept invitation
- After accepting, can access assigned resources
OR: Let guests self-request via Access Packages:
- Create access package with external user policy
- Guests from connected orgs go to My Access portal
- They request access package
- Sponsor/admin approves
- Guest account created automatically
This is more scalable than individual invitations!
27
Configure Guest Expiration
Entra Portal
Navigate to: Identity External Identities External collaboration settings
Guest user expiration (Preview/GA):
If available, configure:
- Guest accounts expire after: 90 days of inactivity
- Auto-remove guests with no assignments: Yes
Alternative: Use Access Reviews for guest cleanup:
Navigate to: Identity governance Access reviews
Create new review
Review type: Teams + Groups
Scope:
"Guest users only" = Yes
All groups with guest users
Settings:
- If no response: Remove access
- Auto-apply: Yes
This creates recurring reviews specifically for
cleaning up guest accounts across all groups.
Also consider:
- Guest access packages with short expiration (90 days)
- Quarterly access reviews for all guests
- Sponsor responsibility for guest lifecycle
28
Monitor Guest Activity
Entra Portal
Monitor guest user activity and access:
Navigate to: Identity Monitoring Sign-in logs
Filter: User type = Guest
View all guest sign-in activity
Navigate to: Identity Users All users
Filter: User type = Guest
See all guest accounts in tenant
For each guest, review:
- Last sign-in date
- Group memberships
- App assignments
- Access package assignments
Audit guest-related events:
Navigate to: Identity Monitoring Audit logs
Filter: Activity = Invite external user
Filter: Activity = Redeem external user invite
Export guest report:
Users Export users
Filter for guests
Use for periodic guest audit
Module 5 Complete!
You've configured B2B collaboration with governance controls. Module 6 covers Terms of Use.
Module 6: Terms of Use & Compliance
Module 6: Implement Compliance Agreements
Require users to accept terms before accessing resources.
30-45 minutes4 stepsEntra Portal
Terms of Use (ToU) require users to acknowledge policies before accessing applications. This is essential for compliance—proving users agreed to acceptable use policies, data handling requirements, or security obligations. ToU can be enforced via Conditional Access and can require re-acceptance when updated.
29
Create Terms of Use Document
Entra Portal
Navigate to: Identity governance Terms of use
Click "New terms"
Create Terms of Use:
- Name: Corporate Acceptable Use Policy
- Display name: Acceptable Use Policy
- Require users to expand: Yes
(Forces user to scroll/expand to read)
- Require users to consent on every device: No
- Expire consents: Yes
- Starting on: [Date]
- Frequency: Annually
Document:
Upload PDF of your acceptable use policy
Language: English
(Can add multiple languages)
Click "Create"
Create another ToU for guests:
- Name: External User Data Agreement
- Target: Guest users
- Content: Rules for accessing company data as external party
30
Enforce ToU with Conditional Access
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: Require-Acceptable-Use-Policy
Assignments:
- Users: All users
- Exclude: Emergency access accounts
Target resources:
- Cloud apps: All cloud apps
OR: Specific sensitive applications
Conditions:
- (None - applies to all conditions)
Access controls Grant:
- Grant access
- ✓ Require terms of use
Select: Corporate Acceptable Use Policy
Click "Select"
Enable policy: On (or Report-only first)
Click "Create"
Users will now be prompted to accept ToU
on next sign-in (and annually when it expires)
31
Create Guest-Specific ToU Policy
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: Require-Guest-Data-Agreement
Assignments:
- Users: Select "Guest or external users"
Select all external user types
Target resources:
- Cloud apps: All cloud apps
OR: Specific apps guests access
Access controls Grant:
- Grant access
- ✓ Require terms of use
Select: External User Data Agreement
- ✓ Require multifactor authentication
Enable policy: On
Click "Create"
Guests must:
1. Complete MFA
2. Accept external user agreement
Before accessing ANY company resources
32
Monitor ToU Acceptance
Entra Portal
Navigate to: Identity governance Terms of use
Select: Corporate Acceptable Use Policy
View acceptance status:
Click "View consents"
Report shows:
- User name
- Acceptance date/time
- Expiration date
- Version accepted
- Device/browser info
Filter by:
- Accepted / Declined / Expired
- Date range
Export for compliance:
Click "Export" Download CSV
For compliance audits, this proves:
- Which users accepted
- When they accepted
- Current acceptance status
Monitor declined/expired:
- Follow up with users who haven't accepted
- Access blocked until accepted
Module 6 Complete!
You've implemented Terms of Use for compliance. Module 7 covers Managed Identities.
Use managed identities for passwordless service authentication.
45-60 minutes5 stepsAzure Portal
Managed identities provide Azure resources with an automatically managed identity in Entra ID. Your code can use this identity to authenticate to services that support Entra ID authentication—without any credentials in your code. No passwords to rotate, no secrets to leak, no credentials to manage. This is the gold standard for Azure workload authentication.
Types of Managed Identities
System-assigned: Created as part of an Azure resource (VM, App Service, etc.). Shares lifecycle with resource—deleted when resource is deleted. One-to-one relationship.
User-assigned: Created as standalone Azure resource. Can be assigned to multiple Azure resources. Independent lifecycle—you control when it's deleted.
33
Enable System-Assigned Managed Identity
Azure Portal
Navigate to: Azure Portal Your App Service (or VM, Function, etc.)
Settings Identity
System assigned tab:
Status: On
Click "Save"
Confirm "Yes"
After enabling:
- Object ID is displayed (this is the identity's ID in Entra ID)
- Principal ID: Used for role assignments
The managed identity is now created in Entra ID.
No credentials are exposed—Azure manages everything.
Verify in Entra ID:
Navigate to: Entra Portal Applications Enterprise applications
Application type: Managed Identities
Find your app's managed identity
34
Create User-Assigned Managed Identity
Azure Portal
Navigate to: Azure Portal Search "Managed Identities"
Click "Create"
Basics:
- Subscription: [Your subscription]
- Resource group: [Select or create]
- Region: [Your region]
- Name: mi-webapp-prod
Click "Review + create" "Create"
Assign to multiple resources:
Navigate to: Your App Service Identity User assigned
Click "Add"
Select: mi-webapp-prod
Click "Add"
Repeat for other resources that need same identity:
- Second App Service
- Azure Function
- Container Instance
User-assigned is ideal when:
- Multiple resources need same permissions
- Identity should persist after resource deletion
- Shared identity across deployments
35
Grant Permissions to Managed Identity
Azure Portal
Grant access to Azure resources (Azure RBAC):
Example: Grant access to Key Vault
Navigate to: Key Vault Access control (IAM)
Click "Add role assignment"
- Role: Key Vault Secrets User
- Members: Select "Managed identity"
Select managed identity: [Your app's identity]
Click "Review + assign"
Example: Grant access to Storage Account
Navigate to: Storage Account Access control (IAM)
Add role assignment
- Role: Storage Blob Data Reader
- Members: Managed identity
Select your managed identity
Click "Review + assign"
Example: Grant access to SQL Database
Navigate to: SQL Server Azure Active Directory
Set AD admin
Then in database:
CREATE USER [mi-webapp-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [mi-webapp-prod];
No passwords needed—identity authenticated automatically!
36
Use Managed Identity in Code
Azure CLI
# Python example using Azure Identity library
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from azure.storage.blob import BlobServiceClient
# DefaultAzureCredential automatically uses managed identity in Azure
credential = DefaultAzureCredential()
# Access Key Vault - no connection string needed!
vault_url = "https://mykeyvault.vault.azure.net/"
secret_client = SecretClient(vault_url=vault_url, credential=credential)
secret = secret_client.get_secret("database-password")
print(f"Retrieved secret: {secret.name}")
# Access Storage - no account key needed!
storage_url = "https://mystorageaccount.blob.core.windows.net/"
blob_service = BlobServiceClient(storage_url, credential=credential)
containers = blob_service.list_containers()
# Access SQL Database - no password needed!
# Use azure-identity with pyodbc
# Connection string uses "Authentication=ActiveDirectoryMsi"
37
Monitor Managed Identity Usage
Entra Portal
Navigate to: Identity Monitoring Sign-in logs
Select "Service principal sign-ins" tab
(Or: "Managed identity sign-ins" if available)
Filter by:
- Service principal: [Your managed identity name]
- Date range
View:
- All authentication attempts by managed identity
- Success/failure status
- Resource accessed
- IP address (Azure infrastructure)
For security monitoring:
- Alert on failed authentications
- Monitor for unusual access patterns
- Track which resources identity accesses
Audit logs:
Navigate to: Identity Monitoring Audit logs
Filter: Target = managed identity name
View permission changes, role assignments
Module 8: Keyless Authentication for CI/CD and Kubernetes
Federate external workloads with Entra ID without secrets.
45-60 minutes5 stepsAzure/Entra Portal
Workload Identity Federation extends the "no secrets" pattern to workloads outside Azure. GitHub Actions, Kubernetes pods, and other platforms can authenticate to Azure using their own identity tokens—no client secrets needed. The external platform issues a token, Entra ID trusts that token, and grants access. This eliminates secret sprawl in CI/CD pipelines.
How Workload Identity Federation Works
External IdP issues token: GitHub Actions, Kubernetes, etc. issue OIDC tokens to their workloads
App registration trusts external IdP: You configure Entra ID to trust tokens from specific issuers
Workload presents token: Your CI/CD job presents its OIDC token to Entra ID
Entra ID exchanges token: If valid, returns an Azure access token
Workload accesses Azure: Uses Azure token to access resources
38
Create App Registration for Federated Workload
Entra Portal
Navigate to: Identity Applications App registrations
Click "New registration"
Register app for CI/CD:
- Name: GitHub-Actions-Deployer
- Supported account types: Single tenant
- Redirect URI: (leave empty)
Click "Register"
Note the values:
- Application (client) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- Directory (tenant) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
This app registration will be used by GitHub Actions
to authenticate WITHOUT a client secret.
39
Configure Federated Credential (GitHub)
Entra Portal
Navigate to: App registrations GitHub-Actions-Deployer
Certificates & secrets Federated credentials
Click "Add credential"
Federated credential scenario:
Select "GitHub Actions deploying Azure resources"
Configure:
- Organization: your-github-org
- Repository: your-repo-name
- Entity type: Branch
- GitHub branch name: main
(OR: Entity type = Environment, Pull request, Tag)
Credential details:
- Name: github-main-branch
- Description: GitHub Actions on main branch
Click "Add"
This creates a trust relationship:
- Entra ID trusts tokens from GitHub
- Only for specified repo/branch/environment
- No client secret needed!
40
Grant Permissions to Federated App
Azure Portal
Grant Azure RBAC permissions to the app registration:
Navigate to: Resource Group (or Subscription) Access control (IAM)
Click "Add role assignment"
Role: Contributor (or more restrictive)
Members:
Select "User, group, or service principal"
Search for: GitHub-Actions-Deployer
Select the app registration
Click "Review + assign"
For specific resources:
- Key Vault: Key Vault Secrets User
- Storage: Storage Blob Data Contributor
- Container Registry: AcrPush
Now GitHub Actions can authenticate and access
these Azure resources—no secrets in GitHub!
41
Configure GitHub Actions Workflow
Azure CLI
# .github/workflows/deploy.yml
name: Deploy to Azure
on:
push:
branches: [main]
permissions:
id-token: write # Required for OIDC
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Azure Login (Federated Credential)
uses: azure/login@v1
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
# NO client-secret needed!
- name: Deploy to Azure
run: |
az webapp deploy --resource-group myRG --name myApp
- name: Access Key Vault
run: |
az keyvault secret show --vault-name myVault --name mySecret
# GitHub secrets needed (NOT sensitive):
# AZURE_CLIENT_ID - App registration client ID
# AZURE_TENANT_ID - Entra ID tenant ID
# AZURE_SUBSCRIPTION_ID - Azure subscription ID
42
Configure Kubernetes Workload Identity
Azure CLI
# For AKS with Workload Identity enabled
# 1. Create user-assigned managed identity
az identity create --name wi-myapp --resource-group myRG
# 2. Get identity details
CLIENT_ID=$(az identity show --name wi-myapp --resource-group myRG --query clientId -o tsv)
IDENTITY_ID=$(az identity show --name wi-myapp --resource-group myRG --query id -o tsv)
# 3. Create federated credential for Kubernetes
az identity federated-credential create \
--name kubernetes-federated \
--identity-name wi-myapp \
--resource-group myRG \
--issuer "https://oidc.prod-aks.azure.com/XXXXXXXX/" \
--subject "system:serviceaccount:default:myapp-sa" \
--audience "api://AzureADTokenExchange"
# 4. Create Kubernetes ServiceAccount
cat <
Module 8 Complete!
You've implemented workload identity federation for keyless CI/CD and Kubernetes authentication.
Governance Security & Best Practices
Identity governance introduces its own attack surface. Misconfigured access packages, overly permissive policies, and unmonitored guest access can create security gaps. Understanding these risks helps you design more secure governance implementations.
CRITICAL
Overly Permissive Access Packages
Access packages that bundle too many resources grant excessive access to requestors.
Mitigation
Create granular packages (role-specific, not department-wide)
Require multi-stage approval for sensitive resources
Set short expiration periods
Regular package audits to review bundled resources
CRITICAL
Stale Guest Accounts
Guest accounts that outlive projects become orphaned access points.
Mitigation
Require access package expiration for all guests
Monthly guest access reviews
Auto-remove guests with no sign-in > 90 days
Sponsor accountability for guest lifecycle
HIGH
Insufficient Access Review Coverage
Resources not covered by access reviews accumulate stale permissions.
Mitigation
Create reviews for ALL groups with sensitive access
Include all applications in review scope
Set "remove access" as default for non-response
Monitor review completion rates
HIGH
Service Principal Secret Sprawl
Client secrets for service principals stored in code, configs, or CI/CD variables.
Mitigation
Use managed identities for Azure workloads
Use workload identity federation for CI/CD
If secrets required: short expiration, store in Key Vault
Monitor for secrets in code repositories
HIGH
Lifecycle Workflow Gaps
Incomplete lifecycle automation leaves access active after termination.
Mitigation
Ensure leaver workflow covers ALL access revocation
Test workflows regularly with sample users
Monitor for accounts without employeeLeaveDateTime
Backup detection: scan for inactive accounts
MEDIUM
Catalog Delegation Risks
Over-delegation of catalog management leads to unauthorized package creation.
Mitigation
Limit catalog owners to trusted administrators
Require IT review for new access packages
Audit catalog changes regularly
Prevent sensitive resources in delegated catalogs
Identity Governance Best Practices
Implement access packages with expiration for ALL access grants
Require multi-stage approval for privileged or sensitive resources
Conduct quarterly access reviews for groups, apps, and privileged roles
Use lifecycle workflows for ALL joiner/mover/leaver scenarios
Set guest account expiration and conduct monthly guest reviews
Eliminate service principal secrets with managed identities and federation
Require Terms of Use acceptance for sensitive applications
Monitor governance audit logs in SIEM
Test lifecycle workflows with sample users quarterly
Document connected organizations and sponsor responsibilities
Use "remove access" as default for non-response in reviews
Even with lifecycle workflows, orphaned accounts can occur. Implement backup detection:
No sign-in > 90 days: Flag for review or auto-disable
No manager attribute: May indicate terminated employee
Missing from HR system: Cross-reference with authoritative source
Access without assignment: Direct permissions bypassing governance
Key Takeaways
You've completed a comprehensive implementation of Entra ID Governance, covering the complete identity lifecycle, self-service access management, external collaboration, and workload identity.
Skills Mastered
Entitlement Management: Catalogs, access packages, and approval workflows
Lifecycle Automation: Joiner/Mover/Leaver workflows with custom tasks
Access Reviews: Periodic certification for groups, apps, and roles
B2B Governance: External identity management with connected organizations
Terms of Use: Compliance enforcement via Conditional Access