Entitlement Management Reports
Governance
The documentation no longer includes the note that nested group drift is excluded and that reports compare assignments with users directly assigned to a group.
Product
Microsoft Entra ID Governance
Track documentation and Message Center changes for Microsoft Entra ID Governance.
Microsoft Learn documentation ↗Latest Microsoft Entra ID Governance changes
Entitlement Management Overview
Fundamentals
The page replaces the Mississippi Division of Medicaid customer example with the Digital Security and Resilience team at Microsoft and updates the accompanying wording and link.
Entitlement Management Overview
Fundamentals
The entitlement management overview removes “preview” from references to assigning groups and API permissions to agents, and from the related license-requirements heading.
Entitlement Management Request Behalf
Governance
The heading for license requirements when requesting on behalf of agent identities no longer includes “(preview).”
Entitlement Management Scenarios
Authentication
The entitlement management scenarios documentation no longer labels “Govern access for agents” as preview.
Identity Governance Overview
Fundamentals
The overview heading and linked page title now refer to “Identity governance for agent identities” and “Governing agent identities,” with the “preview” label removed.
Identity Governance Use Cases
Governance
The identity governance use-cases page no longer labels the Microsoft Entra Agent ID governance topic as “preview.”
Microsoft Entra ID Governance integrations
Authentication
The Entra ID Governance integrations table now lists Secure Cloud and distinguishes Zscaler ZSNet from Zscaler with separate links.
Microsoft Entra ID Governance integrations
Authentication
The overview page now uses a more specific section link and clearer descriptions of automated provisioning, SSO just-in-time provisioning, and additional application integrations.
Cross Tenant Synchronization Overview
Fundamentals
The documentation now states that direct cross-tenant user synchronization requires Microsoft Entra ID P1, while synchronizing a group and its members requires Microsoft Entra ID Governance or Microsoft Entra Suite for each synchronized user in the source tenant.
Entitlement Management Reports
Governance
The entitlement management reports documentation now uses an updated link for the List accessDriftSummary API.
Entitlement Management Reports
Governance
The documentation now links to the Microsoft Graph accessDriftSummary API and separately identifies review through the Microsoft Entra admin center. The page date was also updated.
Microsoft Entra SAP IAG integration
Governance
The page title and heading for Microsoft Entra SAP IAG integration no longer include “(Preview).”
Security Copilot is now included as part of your Microsoft 365 E5/E7 plan
Microsoft identity platform
Updated October 19, 2026: We have identified that this message did not reach it's intended audience. You can safely disregard this message, and we apologize any confusion this may have caused.
Identity Governance Applications Prepare
Governance
The article’s licensing guidance was updated. It states that the tenant needs at least as many licenses as governed member (non-guest) users, including users who request, approve, or review application access.
Microsoft Entra ID Governance licensing fundamentals
Fundamentals
The documentation now lists P1 with Microsoft 365 E3, E5, or E7; P2 with E5 or E7; and Governance capabilities with Microsoft Entra Suite and Microsoft 365 E7. The agent identity licensing reference was also updated.
Entitlement Management Reports
Governance
The documentation date was updated, and the report description now refers to users and agent IDs when explaining direct access and active assignment mismatches.
Configure custom extensions for PIM role activation (Preview)
Governance
The documentation adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also describes collecting attributes such as cost center and project code, along with the required Graph permissions and endpoint configuration.
Microsoft Entra SAP Access Control integration (Preview)
Governance
The documentation describes integrating SAP Access Control with Microsoft Entra entitlement management to govern SAP business roles through catalogs, access packages, and My Access. It covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
Entitlement Management Access Package Auto Assignment Policy
Governance
The documentation now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously.
Entitlement Management Catalog Create
Governance
Added a missing space after the bold “Prerequisite roles:” label. The linked role requirements are unchanged.
Externally determine the approval requirements for an access package using custom extensions
Governance
The entitlement management dynamic approval article received spelling corrections covering custom extensions, Logic Apps, approval setup, and HTTP trigger configuration.
Microsoft Entra ID Governance deployment guide to assign employee access
Architecture
The documentation updates wording across deployment scenarios, entitlement management, access reviews, separation of duties, birthright assignment, and Logic Apps guidance without changing the described capabilities or procedures.
Microsoft Entra ID Governance licensing for guest users
Governance
Corrected spelling in the guest user licensing and governance documentation, including “governance-related.”
Privileged Identity Management Custom Extensions
Governance
The documentation no longer includes the `author` and `ms.author` metadata fields.
Configure Security
Fundamentals
The documentation link was updated from guidance for all multitenant applications to guidance for all applications.
Manage sponsored guests in My Account
Governance
The documentation now directs sponsors to manage guests in My Account at myaccount.microsoft.com, using the Sponsored guests item in the left navigation instead of My Access.
Guest lifecycle policies in Lifecycle Workflows
Governance
The documentation describes configuring guest scopes, lifecycle rules, notifications, precedence, and automated disable or deletion actions for external users.
Manage sponsored guests in My Access
Governance
The new page documents the preview experience for reviewing guests, extending or ending sponsorship, and sponsoring eligible unsponsored guests. It also explains policy-driven lifecycle behavior.
Assign Azure resource roles in Privileged Identity Management
Governance
The documentation now explains that `duration: P365D` makes an eligible assignment expire after 365 days. Permanent eligibility requires the target scope’s role management policy to allow it.
Apps
Governance
The Entra ID Governance apps page no longer lists Workplace from Meta in its application table.
Microsoft Entra Id Governance Licensing For Guest Users
Governance
The licensing table now covers guests disabled or deleted by lifecycle policies, sponsor attestations, and users sponsoring new guests. It also lists the related beta API endpoints for attestation and sponsorship.
Road To The Cloud Implement
Architecture
The guidance now links to a different Microsoft Entra Cloud Sync configuration page for provisioning groups to Active Directory Domain Services.
Pim For Groups
Fundamentals
The documentation now states that credential protection covers group members and owners, including eligible members and owners who have not yet activated.
Pim For Groups
Fundamentals
The role-assignable groups description now includes members and owners, including eligible members and owners who have not activated their assignments.
Reconciliation overview - Microsoft Entra ID Governance
Fundamentals
The overview describes access drift, account discovery, access package drift detection, and enforcement and remediation approaches for aligning resource access with governance policies.
View reports and logs in entitlement management
Governance
The documentation adds access package drift reporting for groups and enterprise applications, including detection, remediation, export, roles, licensing, refresh timing, and limitations. The reports are in preview.
Extend Application Attributes
Governance
The documentation now uses clearer wording for configuring LCW extensibility workflow mappings, creating an Azure Logic App and workflow, and configuring provisioning jobs with attribute mappings.
Entitlement Management Access Package Create
Governance
The access package creation documentation now explains that the search box can find matching SharePoint Online roles that are not initially displayed, especially on sites with many roles.
Entitlement Management Access Package Resources
Governance
The documentation now recommends using the search box to find SharePoint Online roles when adding them to an access package. Search returns matching roles even when they are not initially displayed.
Licensing
Governance
The licensing documentation’s Microsoft author alias was updated from `tafra00` to `tazkiaafra`.
Licensing
Fundamentals
The page now lists the Microsoft Agent 365 Licensing FAQs and governance relationships links without the previous section heading and introductory text.
Licensing
Governance
The Tenant Governance licensing page now links to Microsoft Agent 365 licensing FAQs and guidance for using governance relationships with Microsoft Defender.
Microsoft Entra ID Governance licensing fundamentals
Fundamentals
The licensing fundamentals page was updated to align the Account Discovery section and state that the feature requires the Microsoft Entra ID Governance add-on or Microsoft Entra Suite.
Entitlement Management Access Package Request Policy
Governance
The documentation now specifies that existing guest users can be directly assigned, but external users who are not yet in the directory cannot be invited through direct assignment when access is limited to administrator direct assignments.
Apps
Governance
The HR integrations table now includes a link for HiBob to Microsoft Entra ID/Active Directory and updates the Rippling provisioning link text.
Entitlement Management Request Behalf
Governance
The documentation now directs administrators to the **Who can request access** section on the **Requests** tab, where selecting **Manager** enables managers to request access packages for employees.
Pim How To Use Audit Log
Governance
The documentation explains that related PIM activation and deactivation events can have different CorrelationId values. It recommends using roleAssignmentRequestId to trace a complete request and adds Log Analytics query examples.
Entitlement Management Request Behalf
Governance
The documentation now uses a new screenshot showing configuration of an access package’s request-on-behalf-of policy.
Road To The Cloud Implement
Architecture
The documentation now links to the Microsoft Entra Cloud Sync group provisioning tutorial instead of the configuration guide.
Source Of Authority Overview
Fundamentals
The guidance for recreating AD DS groups as cloud security groups, provisioning them as Universal groups, and updating applications to use their new security identifiers was revised.
Privileged Identity Management Custom Extensions
Microsoft identity platform
The documentation now uses revised Application (client) ID examples in the endpoint URI and `resourceId` configuration sample.
Privileged Identity Management Custom Extensions
Microsoft identity platform
The documentation now consistently uses a different application client ID in the endpoint URI, calling application claim, and `resourceId` examples.
Road To The Cloud Implement
Architecture
The guidance now links to a different Microsoft Entra Cloud Sync article for provisioning groups to Active Directory Domain Services.
Source Of Authority Overview
Fundamentals
The documentation now describes creating new cloud security groups in Microsoft Entra ID, provisioning them to AD DS as Universal groups, and updating applications to use the new group security identifiers.
Create Tenant
Governance
The article now states that a governance relationship and related resources are established only when the home tenant has a default governance policy template.
Create Tenant
Governance
The documentation now states that the Tenant Creator role is required regardless of the “Restrict non-admin users from creating tenants” setting.
Create Lifecycle Workflow
Governance
The page removes the standalone setup section and detailed steps for configuring relative time-based triggers, including timing options, offsets, supported attributes, and enablement notes.
Create Lifecycle Workflow
Governance
Administrators can configure triggers using operators, offsets from 0 to 180 days, before or after event timing, and supported user attributes such as hire date, leave date, and creation date. Both the workflow and its schedule must be enabled for evaluation.
Entitlement Management Request Behalf
Governance
The documentation adds examples describing how designated users can request access packages for others and clarifies that both requestors and targets need the required license.
Lifecycle Workflow Execution Conditions
Governance
The allowed offset for Days from event, and Days to event when using Between, increased from 180 to 365 days.
Lifecycle Workflow Execution Conditions
Governance
The Event user attribute description in the lifecycle workflow execution conditions documentation was reformatted.
Lifecycle Workflow Execution Conditions
Governance
Documentation describes relative comparisons using Exactly, Between, or Less than or equal to, with event offsets from 0 to 180 days before or after supported user-attribute dates. The admin center temporarily shows two choices for the same time-based trigger.
Understanding Lifecycle Workflows
Governance
The documentation now explains that relative time-based comparisons expand the standard time-based attribute trigger. During preview, the admin center shows two choices, but both represent the same trigger.
Understanding Lifecycle Workflows
Fundamentals
The documentation now describes the Time based attribute V2 trigger, including Exactly, Less than or equal to, and Between comparisons with offsets from 0 to 180 days before or after a date attribute. It also documents that workflows and schedules must be enabled and that V2 has no three-day catch-up window.
Automatic formation of governance relationships
Governance
The documentation now specifies selecting an existing Microsoft Customer Agreement (MCA) subscription and resource group from the billing account when creating a tenant with the secure add-on tenant creation feature.
Automatic formation of governance relationships
Governance
The documentation now specifies that secure add-on tenant creation requires an existing paid Azure subscription and resource group, with the subscription associated with an Enterprise Agreement.
Automatic Governance Relationships
Governance
The secure add-on tenant creation documentation now refers to selecting an existing subscription, rather than specifically an existing Microsoft Customer Agreement subscription, from the billing account.
Create a governed workforce tenant
Governance
The documentation now specifies paid-account, billing, tenant-creation permission, role, and default governance-policy requirements for creating governed workforce tenants. Free or trial tenants cannot create additional tenants, and EA or pay-as-you-go billing accounts are supported.
Create Lifecycle Workflow
Governance
The documentation now describes creating a lifecycle workflow by cloning an existing workflow in the Microsoft Entra admin center, including review and customization steps.
Create Tenant
Governance
The tenant creation guidance now links references to the Microsoft Entra ID Free billing asset to the relevant billing documentation instead of the previous signals-and-metrics page.
Create Tenant
Governance
The documentation now says the home tenant—not the governing tenant—must have the default governance policy template for this optional prerequisite. The service uses the template with ID `default`.
Create Tenant
Governance
The documentation now labels the governing tenant’s default governance policy template as optional instead of a required prerequisite. The tenant creation service still uses only the default template (ID: `default`).
Create Tenant
Governance
The documentation now explicitly states that the required Enterprise Agreement or Pay-As-You-Go subscription must be paid.
Create Tenant
Governance
The prerequisite now specifies that the home tenant must have at least one paid, license-based Microsoft product. Free and trial licenses do not qualify.
Create Tenant
Governance
The guide now links the Microsoft Online Subscription Agreement (MOSA) in its billing-account prerequisites. The Enterprise Agreement and Pay-As-You-Go references remain.
Create Tenant
Governance
The prerequisite now refers to Enterprise Agreement or Pay-As-You-Go subscriptions and identifies MOSA and MCA subscriptions, replacing billing-account wording.
Create Tenant
Governance
The tenant creation guide now explicitly states that the required subscription permissions are Azure Resource Manager (ARM) permissions, provided through the Tenant Contributor or Subscription Owner/Creator role.
Deploy Microsoft Entra Tenant Governance end to end
Governance
The deployment guide now documents a paid Azure subscription linked to an Enterprise Agreement or pay-as-you-go billing account, with Tenant Contributor or Subscription Owner/Creator access for the selected subscription.
Deployment Guide
Fundamentals
The secure tenant creation guidance now links the Microsoft Online Subscription Agreement (MOSA) reference alongside the existing Enterprise Agreement and Pay-As-You-Go links.
Deployment Guide
Fundamentals
The deployment guide now refers to either a paid Enterprise Agreement or Pay-As-You-Go subscription and adds Microsoft Online Subscription Agreement terminology.
Deployment Guide
Fundamentals
The secure tenant creation prerequisites were updated to clarify the required Azure Resource Manager permissions.
Lifecycle Workflow Tasks
Fundamentals
The task now applies to both leaver and mover templates. For mover templates, scheduled removal defaults to 15 days; administrators can customize the timing or choose immediate removal.
Lifecycle Workflow Templates
Governance
The mover workflow templates now list the “Remove all access package assignments for user” task, with removal scheduled by default for 15 days.
Lifecycle Workflows Deployment
Governance
The task is now listed for both Leaver and Mover templates. The documentation also states that setting daysUntilExpiration schedules removal instead of removing assignments immediately.
Lifecycle Workflows Tasks Table
Governance
The lifecycle workflows task table now lists “Remove all access package assignments for user” for both Leaver and Mover workflow templates.
Tutorial Mover Custom Workflow Portal
Governance
The tutorial now includes a task that removes all access package assignments for a user, scheduled by default for 15 days.
Delegate approvals and access reviews in My Access (Preview)
Governance
The documentation now covers delegating multi-resource access reviews in addition to access package approvals. It also documents restrictions for delegate selection and maximum delegation duration.
Entitlement Management Access Package Assignments
Governance
The access package assignments page no longer includes a note stating that assignment managers cannot bypass required approval settings or directly assign identities without approval.
Entitlement Management Access Package Request Policy
Governance
The documentation now expands its guidance that administrators must verify users meet existing access package policy requirements before assigning them; otherwise, assignment may fail.
Entitlement Management Access Package Request Policy
Governance
The documentation removes an inaccurate statement implying that direct assignment to an access package requires approval. It now states only that assigned users must meet the policy’s eligibility requirements.
Entitlement Management Delegate
Governance
The entitlement management delegation documentation removes a note about access package assignment managers being unable to bypass approval requirements when directly assigning identities.
Catalog Access Reviews
Governance
The documentation no longer labels Catalog Access Reviews or custom data provided resources as preview. It also generalizes reviewers beyond managers and adds a note that changes within 12 hours before a review starts may not appear.
Catalog Access Reviews
Governance
The page no longer labels Catalog Access Reviews or Custom Data Provided Resource as preview. It updates wording from managers to reviewers, removes the statement that managers are primary reviewers, adds a 12-hour data-change limitation before review start, and updates links.
Include custom data provided resource in the catalog for catalog user Access Reviews
Governance
The guide removes the Preview label and adds steps for creating the resource and Logic App, automatic upload notifications, manual result application, and new resource parameters.
Include custom data provided resource in the catalog for catalog user Access Reviews
Governance
The page no longer labels the capability as Preview and now documents catalog resource setup, Logic App integration, manual uploads, and applying results to non-Approve decisions. The previous note about single-stage reviews with manager reviewers was removed.
Licensing Governance
Governance
The governance licensing documentation now includes “PIM - Custom extensions for role activation (Preview)” with licensing indicators.
Entitlement Management Access Package Auto Assignment Policy
Governance
The documentation now states that support for the `memberOf` rule operator ends November 3, 2026, replacing October 27, 2026. Policies using it will be quarantined and stop processing assignments from that date.
Configure an automatic assignment policy for an access package in entitlement management
Governance
The documentation states that, starting October 27, 2026, automatic assignment policies using memberOf will be quarantined. Assignment processing will stop, and no assignments will be added or removed until memberOf is removed.
Automatic Governance Relationships
Governance
When you create a new Microsoft Entra tenant using the secure add-on tenant creation feature, you're prompted to select an existing subscription and resource group from your billing account. When you create your new tenant, Microsoft generates a new billing asset called **Entra ID Free** under that subscription and resource group, which links to the newly created tenant.
Configure configuration management service permissions
Governance
Learn how to assign or remove the application permissions and roles that the Tenant Configuration Management service uses to create snapshots and run monitors
Create a configuration monitor
Governance
Learn how to create a configuration monitor in Microsoft Entra Tenant Governance to evaluate a tenant against a configuration baseline and report drift
Create a governed workforce tenant
Governance
Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant.
Create configuration snapshots
Governance
Learn how to create configuration snapshots in Microsoft Entra Tenant Governance to capture tenant configuration for baselines or audit evidence
Deploy Microsoft Entra Tenant Governance end to end
Governance
Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
Lifecycle Workflow Unsponsored Guest Removal
Governance
This article walks you through managing unsponsored guests using the **Unsponsored guest cleanup (Preview)** workflow template.
View monitor results and manage monitors
Governance
Learn how to view monitor results and configuration drifts and manage configuration monitors in Microsoft Entra Tenant Governance
Cross-tenant delegated administration
Governance
Learn about cross-tenant delegated administration and the GDAP-based permission model for managing tenants in Microsoft Entra.
Customize Workflow Email
Governance
In the message body, you can customize the email text to personalize it for each recipient. You can optionally include built-in user attributes, custom security attributes, directory extensions, and on-premises extension attributes by embedding them in the text. Before the email is sent, the placeholders are replaced with the actual user information.
Governance Policy Templates
Governance
- Manage the governed tenant without needing a local or business-to-business (B2B) account in that tenant.
Interpret tenant discovery data
Governance
Learn how to interpret tenant discovery data, signals, and metrics in Microsoft Entra Tenant Governance to assess related tenants
Investigate related tenant signals by using Microsoft Graph (preview)
Governance
Learn how to use Microsoft Graph to retrieve the underlying users and applications behind Tenant Governance related tenant discovery signals.
Lifecycle Workflow Tasks
Governance
With customized emails, you're able to include dynamic attributes within the subject and body to personalize these emails. You can include built-in user attributes, custom security attributes, directory extensions, and on-premises extension attributes. The list of dynamic attributes that can be included are as follows:
Related tenants in Tenant Governance
Governance
Learn how Microsoft Entra Tenant Governance discovers related tenants through identity, application, and billing signals across your organization
Use cross-tenant delegated administration
Governance
Learn how to use cross-tenant delegated administration to sign in to and manage governed tenants using your governing tenant credentials
Lifecycle Workflow Inactive Users
Governance
1. Under the **Days of inactivity**, enter the number of days you want the trigger to run for if exceeded, and then select **Next**.
Lifecycle Workflow Templates
Governance
The **Pre-Offboard inactive users** template is designed to configure tasks that must be completed before offboarding inactive users.
Simulate workflow execution using the What-if tool
Governance
Learn how to use the What-if tool in Lifecycle Workflows to simulate workflow execution and preview results without impacting actual users.