Agent Default Inactivity Policy
Governance
The Agent ID default inactivity policy page updates links to related lifecycle policy and end-user agent management documentation.
Cross-product topic
Governance
A cross-product view of Microsoft Entra changes related to Governance.
Latest Governance changes
Entitlement Management Reports
Governance
The documentation no longer includes the note that nested group drift is excluded and that reports compare assignments with users directly assigned to a group.
Entitlement Management Request Behalf
Governance
The heading for license requirements when requesting on behalf of agent identities no longer includes “(preview).”
Identity Governance Use Cases
Governance
The identity governance use-cases page no longer labels the Microsoft Entra Agent ID governance topic as “preview.”
Entra Agent ID lifecycle policies (preview)
Governance
The documentation now directs administrators to **Agent ID (Preview)** instead of **Agent IDs**, and updates the introductory wording about agent identity lifecycle risks.
Microsoft Entra Agent ID default inactivity policy
Governance
The documentation describes a preview policy that notifies owners after 60 days of inactivity, disables identities after 90 days, and deletes them after 455 days. Administrators can enable it, configure its scope, and set fallback notification recipients.
Entitlement Management Reports
Governance
The entitlement management reports documentation now uses an updated link for the List accessDriftSummary API.
Entitlement Management Reports
Governance
The documentation now links to the Microsoft Graph accessDriftSummary API and separately identifies review through the Microsoft Entra admin center. The page date was also updated.
Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
Governance
Microsoft Defender for Cloud Apps will update App Governance permissions for select Microsoft Entra roles starting mid-November 2026. Changes include role-based access control alignment with Defender XDR, affecting Cloud App Security, Compliance Administrator, and Compliance Data Administrator roles. Admins should review and update role assignments accordingly.
Microsoft Entra SAP IAG integration
Governance
The page title and heading for Microsoft Entra SAP IAG integration no longer include “(Preview).”
Identity Governance Applications Prepare
Governance
The article’s licensing guidance was updated. It states that the tenant needs at least as many licenses as governed member (non-guest) users, including users who request, approve, or review application access.
Entitlement Management Reports
Governance
The documentation date was updated, and the report description now refers to users and agent IDs when explaining direct access and active assignment mismatches.
Configure custom extensions for PIM role activation (Preview)
Governance
The documentation adds postapproval extensions with deferred outcomes and asynchronous validation before assignment provisioning. It also describes collecting attributes such as cost center and project code, along with the required Graph permissions and endpoint configuration.
Microsoft Entra SAP Access Control integration (Preview)
Governance
The documentation describes integrating SAP Access Control with Microsoft Entra entitlement management to govern SAP business roles through catalogs, access packages, and My Access. It covers SAP BTP, Cloud Connector, prerequisites, licensing, and status reconciliation.
Microsoft Purview | Information Protection: Sensitivity labels for Microsoft Entra security groups
Governance
Microsoft Purview will enable sensitivity labels for Microsoft Entra cloud security groups starting mid-November 2026, allowing administrators to apply and enforce governance policies on these groups. Labels can be assigned via multiple platforms, cannot yet be changed once applied, and require separate tenant configuration from Microsoft 365 groups.
Entra Agent ID lifecycle policies
Governance
The article explains how to create policies for agent identities, including periodic reconfirmation, minimum sponsor requirements, inactivity monitoring, notifications, grace periods, and enforcement actions. The capability is in preview.
Entitlement Management Access Package Auto Assignment Policy
Governance
The documentation now clarifies that multiple automatic assignment policies for one access package are supported only when users do not match multiple policies simultaneously.
Entitlement Management Access Package Resources
Governance
The documentation now identifies the resource role as applying to an AI agent’s service principal or agent ID and adds numbered steps for selecting API permissions, permission type, required permissions, and updating the configuration.
Entitlement Management Catalog Create
Governance
Added a missing space after the bold “Prerequisite roles:” label. The linked role requirements are unchanged.
Externally determine the approval requirements for an access package using custom extensions
Governance
The entitlement management dynamic approval article received spelling corrections covering custom extensions, Logic Apps, approval setup, and HTTP trigger configuration.
Microsoft Entra ID Governance licensing for guest users
Governance
Corrected spelling in the guest user licensing and governance documentation, including “governance-related.”
Privileged Identity Management Custom Extensions
Governance
The documentation no longer includes the `author` and `ms.author` metadata fields.
Manage sponsored guests in My Account
Governance
The documentation now directs sponsors to manage guests in My Account at myaccount.microsoft.com, using the Sponsored guests item in the left navigation instead of My Access.
Guest lifecycle policies in Lifecycle Workflows
Governance
The documentation describes configuring guest scopes, lifecycle rules, notifications, precedence, and automated disable or deletion actions for external users.
Manage sponsored guests in My Access
Governance
The new page documents the preview experience for reviewing guests, extending or ending sponsorship, and sponsoring eligible unsponsored guests. It also explains policy-driven lifecycle behavior.
Assign Azure resource roles in Privileged Identity Management
Governance
The documentation now explains that `duration: P365D` makes an eligible assignment expire after 365 days. Permanent eligibility requires the target scope’s role management policy to allow it.
Apps
Governance
The Entra ID Governance apps page no longer lists Workplace from Meta in its application table.
Microsoft Entra Id Governance Licensing For Guest Users
Governance
The licensing table now covers guests disabled or deleted by lifecycle policies, sponsor attestations, and users sponsoring new guests. It also lists the related beta API endpoints for attestation and sponsorship.
View reports and logs in entitlement management
Governance
The documentation adds access package drift reporting for groups and enterprise applications, including detection, remediation, export, roles, licensing, refresh timing, and limitations. The reports are in preview.
Extend Application Attributes
Governance
The documentation now uses clearer wording for configuring LCW extensibility workflow mappings, creating an Azure Logic App and workflow, and configuring provisioning jobs with attribute mappings.
Discover identities in target applications with account discovery
Governance
Account discovery now covers users and groups, classifying them as local, unassigned, or assigned identities. Group discovery is identified as being in preview, and correlation requires a direct matching attribute.
Entitlement Management Access Package Create
Governance
The access package creation documentation now explains that the search box can find matching SharePoint Online roles that are not initially displayed, especially on sites with many roles.
Entitlement Management Access Package Resources
Governance
The documentation now recommends using the search box to find SharePoint Online roles when adding them to an access package. Search returns matching roles even when they are not initially displayed.
Licensing
Governance
The licensing documentation’s Microsoft author alias was updated from `tafra00` to `tazkiaafra`.
Licensing
Governance
The Tenant Governance licensing page now links to Microsoft Agent 365 licensing FAQs and guidance for using governance relationships with Microsoft Defender.
Entitlement Management Access Package Request Policy
Governance
The documentation now specifies that existing guest users can be directly assigned, but external users who are not yet in the directory cannot be invited through direct assignment when access is limited to administrator direct assignments.
Permissions Reference
Governance
The AI Administrator and AI Reader descriptions were updated from “Microsoft 365 Copilot” to “Microsoft Copilot.” Their role IDs remain unchanged.
Agent Owners Sponsors Managers
Governance
Sponsors can disable agent identities, modify sponsors, and soft-delete resources, but cannot enable or restore agent blueprints or identities.
Apps
Governance
The HR integrations table now includes a link for HiBob to Microsoft Entra ID/Active Directory and updates the Rippling provisioning link text.
Entitlement Management Request Behalf
Governance
The documentation now directs administrators to the **Who can request access** section on the **Requests** tab, where selecting **Manager** enables managers to request access packages for employees.
Microsoft Entra ID Entitlement Management integration with ServiceNow
Governance
The documentation now explains how Entitlement Management integrates with ServiceNow for access package requests, request history, and approvals. It covers licensing, installation, configuration, and user workflows.
Pim How To Use Audit Log
Governance
The documentation explains that related PIM activation and deactivation events can have different CorrelationId values. It recommends using roleAssignmentRequestId to trace a complete request and adds Log Analytics query examples.
Entitlement Management Request Behalf
Governance
The documentation now uses a new screenshot showing configuration of an access package’s request-on-behalf-of policy.
Create Tenant
Governance
The article now states that a governance relationship and related resources are established only when the home tenant has a default governance policy template.
Create Tenant
Governance
The documentation now states that the Tenant Creator role is required regardless of the “Restrict non-admin users from creating tenants” setting.
Create Lifecycle Workflow
Governance
The page removes the standalone setup section and detailed steps for configuring relative time-based triggers, including timing options, offsets, supported attributes, and enablement notes.
Create Lifecycle Workflow
Governance
Administrators can configure triggers using operators, offsets from 0 to 180 days, before or after event timing, and supported user attributes such as hire date, leave date, and creation date. Both the workflow and its schedule must be enabled for evaluation.
Entitlement Management Request Behalf
Governance
The documentation adds examples describing how designated users can request access packages for others and clarifies that both requestors and targets need the required license.
Lifecycle Workflow Execution Conditions
Governance
The allowed offset for Days from event, and Days to event when using Between, increased from 180 to 365 days.
Lifecycle Workflow Execution Conditions
Governance
The Event user attribute description in the lifecycle workflow execution conditions documentation was reformatted.
Lifecycle Workflow Execution Conditions
Governance
Documentation describes relative comparisons using Exactly, Between, or Less than or equal to, with event offsets from 0 to 180 days before or after supported user-attribute dates. The admin center temporarily shows two choices for the same time-based trigger.
Understanding Lifecycle Workflows
Governance
The documentation now explains that relative time-based comparisons expand the standard time-based attribute trigger. During preview, the admin center shows two choices, but both represent the same trigger.
Automatic formation of governance relationships
Governance
The documentation now specifies selecting an existing Microsoft Customer Agreement (MCA) subscription and resource group from the billing account when creating a tenant with the secure add-on tenant creation feature.
Automatic formation of governance relationships
Governance
The documentation now specifies that secure add-on tenant creation requires an existing paid Azure subscription and resource group, with the subscription associated with an Enterprise Agreement.
Automatic Governance Relationships
Governance
The secure add-on tenant creation documentation now refers to selecting an existing subscription, rather than specifically an existing Microsoft Customer Agreement subscription, from the billing account.
Create a governed workforce tenant
Governance
The documentation now specifies paid-account, billing, tenant-creation permission, role, and default governance-policy requirements for creating governed workforce tenants. Free or trial tenants cannot create additional tenants, and EA or pay-as-you-go billing accounts are supported.
Create Lifecycle Workflow
Governance
The documentation now describes creating a lifecycle workflow by cloning an existing workflow in the Microsoft Entra admin center, including review and customization steps.
Create Tenant
Governance
The tenant creation guidance now links references to the Microsoft Entra ID Free billing asset to the relevant billing documentation instead of the previous signals-and-metrics page.
Create Tenant
Governance
The documentation now says the home tenant—not the governing tenant—must have the default governance policy template for this optional prerequisite. The service uses the template with ID `default`.
Create Tenant
Governance
The documentation now labels the governing tenant’s default governance policy template as optional instead of a required prerequisite. The tenant creation service still uses only the default template (ID: `default`).
Create Tenant
Governance
The documentation now explicitly states that the required Enterprise Agreement or Pay-As-You-Go subscription must be paid.
Create Tenant
Governance
The prerequisite now specifies that the home tenant must have at least one paid, license-based Microsoft product. Free and trial licenses do not qualify.
Create Tenant
Governance
The guide now links the Microsoft Online Subscription Agreement (MOSA) in its billing-account prerequisites. The Enterprise Agreement and Pay-As-You-Go references remain.
Create Tenant
Governance
The prerequisite now refers to Enterprise Agreement or Pay-As-You-Go subscriptions and identifies MOSA and MCA subscriptions, replacing billing-account wording.
Create Tenant
Governance
The tenant creation guide now explicitly states that the required subscription permissions are Azure Resource Manager (ARM) permissions, provided through the Tenant Contributor or Subscription Owner/Creator role.
Deploy Microsoft Entra Tenant Governance end to end
Governance
The deployment guide now documents a paid Azure subscription linked to an Enterprise Agreement or pay-as-you-go billing account, with Tenant Contributor or Subscription Owner/Creator access for the selected subscription.
Lifecycle Workflow Templates
Governance
The mover workflow templates now list the “Remove all access package assignments for user” task, with removal scheduled by default for 15 days.
Lifecycle Workflows Deployment
Governance
The task is now listed for both Leaver and Mover templates. The documentation also states that setting daysUntilExpiration schedules removal instead of removing assignments immediately.
Lifecycle Workflows Tasks Table
Governance
The lifecycle workflows task table now lists “Remove all access package assignments for user” for both Leaver and Mover workflow templates.
Tutorial Mover Custom Workflow Portal
Governance
The tutorial now includes a task that removes all access package assignments for a user, scheduled by default for 15 days.
Delegate approvals and access reviews in My Access (Preview)
Governance
The documentation now covers delegating multi-resource access reviews in addition to access package approvals. It also documents restrictions for delegate selection and maximum delegation duration.
Entitlement Management Access Package Assignments
Governance
The access package assignments page no longer includes a note stating that assignment managers cannot bypass required approval settings or directly assign identities without approval.
Entitlement Management Access Package Request Policy
Governance
The documentation now expands its guidance that administrators must verify users meet existing access package policy requirements before assigning them; otherwise, assignment may fail.
Entitlement Management Access Package Request Policy
Governance
The documentation removes an inaccurate statement implying that direct assignment to an access package requires approval. It now states only that assigned users must meet the policy’s eligibility requirements.
Entitlement Management Delegate
Governance
The entitlement management delegation documentation removes a note about access package assignment managers being unable to bypass approval requirements when directly assigning identities.
Catalog Access Reviews
Governance
The documentation no longer labels Catalog Access Reviews or custom data provided resources as preview. It also generalizes reviewers beyond managers and adds a note that changes within 12 hours before a review starts may not appear.
Catalog Access Reviews
Governance
The page no longer labels Catalog Access Reviews or Custom Data Provided Resource as preview. It updates wording from managers to reviewers, removes the statement that managers are primary reviewers, adds a 12-hour data-change limitation before review start, and updates links.
Include custom data provided resource in the catalog for catalog user Access Reviews
Governance
The guide removes the Preview label and adds steps for creating the resource and Logic App, automatic upload notifications, manual result application, and new resource parameters.
Include custom data provided resource in the catalog for catalog user Access Reviews
Governance
The page no longer labels the capability as Preview and now documents catalog resource setup, Logic App integration, manual uploads, and applying results to non-Approve decisions. The previous note about single-stage reviews with manager reviewers was removed.
Licensing Governance
Governance
The governance licensing documentation now includes “PIM - Custom extensions for role activation (Preview)” with licensing indicators.
Discover identities in target applications with account discovery
Governance
The article was revised to use lowercase “account discovery,” clarify connector and limitation wording, update the GitHub reference, and change its date from May 26, 2026, to August 11, 2026. It continues to describe the existing discovery process and requirements.
Entitlement Management Access Package Auto Assignment Policy
Governance
The documentation now states that support for the `memberOf` rule operator ends November 3, 2026, replacing October 27, 2026. Policies using it will be quarantined and stop processing assignments from that date.
Configure an automatic assignment policy for an access package in entitlement management
Governance
The documentation states that, starting October 27, 2026, automatic assignment policies using memberOf will be quarantined. Assignment processing will stop, and no assignments will be added or removed until memberOf is removed.
Automatic Governance Relationships
Governance
When you create a new Microsoft Entra tenant using the secure add-on tenant creation feature, you're prompted to select an existing subscription and resource group from your billing account. When you create your new tenant, Microsoft generates a new billing asset called **Entra ID Free** under that subscription and resource group, which links to the newly created tenant.
Configure configuration management service permissions
Governance
Learn how to assign or remove the application permissions and roles that the Tenant Configuration Management service uses to create snapshots and run monitors
Create a configuration monitor
Governance
Learn how to create a configuration monitor in Microsoft Entra Tenant Governance to evaluate a tenant against a configuration baseline and report drift
Create a governed workforce tenant
Governance
Learn how to securely create a governed Microsoft Entra workforce tenant and establish governance from your home tenant.
Create configuration snapshots
Governance
Learn how to create configuration snapshots in Microsoft Entra Tenant Governance to capture tenant configuration for baselines or audit evidence
Deploy Microsoft Entra Tenant Governance end to end
Governance
Learn how to deploy Microsoft Entra Tenant Governance from setup through tenant discovery, governance, and configuration monitoring
Lifecycle Workflow Unsponsored Guest Removal
Governance
This article walks you through managing unsponsored guests using the **Unsponsored guest cleanup (Preview)** workflow template.
View monitor results and manage monitors
Governance
Learn how to view monitor results and configuration drifts and manage configuration monitors in Microsoft Entra Tenant Governance
Cross-tenant delegated administration
Governance
Learn about cross-tenant delegated administration and the GDAP-based permission model for managing tenants in Microsoft Entra.
Customize Workflow Email
Governance
In the message body, you can customize the email text to personalize it for each recipient. You can optionally include built-in user attributes, custom security attributes, directory extensions, and on-premises extension attributes by embedding them in the text. Before the email is sent, the placeholders are replaced with the actual user information.
Governance Policy Templates
Governance
- Manage the governed tenant without needing a local or business-to-business (B2B) account in that tenant.
Interpret tenant discovery data
Governance
Learn how to interpret tenant discovery data, signals, and metrics in Microsoft Entra Tenant Governance to assess related tenants
Investigate related tenant signals by using Microsoft Graph (preview)
Governance
Learn how to use Microsoft Graph to retrieve the underlying users and applications behind Tenant Governance related tenant discovery signals.
Lifecycle Workflow Tasks
Governance
With customized emails, you're able to include dynamic attributes within the subject and body to personalize these emails. You can include built-in user attributes, custom security attributes, directory extensions, and on-premises extension attributes. The list of dynamic attributes that can be included are as follows:
Prerequisites
Governance
- Microsoft Entra Cloud Sync agent must be installed on a domain-joined server. We recommend using Windows Server 2025 or Windows Server 2022. You can also deploy Microsoft Entra Cloud Sync on older Windows Server versions that are in extended support; however, support for this configuration may require [a paid support program](/lifecycle/policies/fixed#extended-support).
Related tenants in Tenant Governance
Governance
Learn how Microsoft Entra Tenant Governance discovers related tenants through identity, application, and billing signals across your organization
Use cross-tenant delegated administration
Governance
Learn how to use cross-tenant delegated administration to sign in to and manage governed tenants using your governing tenant credentials
Lifecycle Workflow Inactive Users
Governance
1. Under the **Days of inactivity**, enter the number of days you want the trigger to run for if exceeded, and then select **Next**.
Lifecycle Workflow Templates
Governance
The **Pre-Offboard inactive users** template is designed to configure tasks that must be completed before offboarding inactive users.
Simulate workflow execution using the What-if tool
Governance
Learn how to use the What-if tool in Lifecycle Workflows to simulate workflow execution and preview results without impacting actual users.
Microsoft Entra Id Governance Licensing For Guest Users
Governance
Learn how Microsoft Entra ID is licensed for guest users.
Governance Policy Templates
Governance
Learn about governance policy templates and how to use them to enforce consistent governance across tenants in Microsoft Entra
Microsoft Entra: Blocking new assignments to partner tier support roles
Governance
Microsoft Entra will block new assignments to Partner Tier1 and Tier2 Support roles starting August 3, 2026, as these roles are retired. Existing assignments remain valid. Admins should update scripts and use alternative roles like User Administrator. No impact if these roles aren't used.
Assign Azure Role-based access control (RBAC) Roles - Entitlement management (Preview)
Governance
Assign Azure RBAC roles to access packages and catalogs in Microsoft Entra Entitlement Management. Learn how to manage access with least privilege principles.
Configure execution limits for Lifecycle Workflows
Governance
Learn how to set tenant-wide and workflow-specific execution limits and manage quarantined workflows in Lifecycle Workflows to prevent large-scale impact.
Govern cloud users and groups with provisioning from on-premises and Entra Connect Cloud Sync
Governance
This article a tutorial on how to provision users and groups using cloud sync.
Govern on-premises Active Directory based apps (Kerberos) with Microsoft Entra Cloud Sync
Governance
This article a tutorial on how to provision users and groups from and managed in Microsoft Entra ID to Active Directory.
Integrate Darwinbox HR With Microsoft Entra ID
Governance
Learn how to integrate Darwinbox HR with Microsoft Entra ID to automate user provisioning, manage lifecycle workflows, and streamline HR-driven processes.
PowerShell sample - List Microsoft Entra Backup and Recovery snapshots for Global Secure Access recovery
Governance
List Microsoft Entra Backup and Recovery snapshots that can help recover directory objects used by Global Secure Access.
Configure execution limits for Lifecycle Workflows
Governance
Learn how to set tenant-wide and workflow-specific execution limits and manage quarantined workflows in Lifecycle Workflows to prevent large-scale impact.
Entitlement Management Access Package Create App
Governance
1. Assign all discovered users to a specific access package:
Configure Requestor Visibility of Approver Details
Governance
Learn how to configure whether requestors can see approver details for pending access package requests in the My Access portal at the tenant or package level.
Entitlement Management Access Package Assignments
Governance
In entitlement management, you can see who is assigned to access packages, their policy, status, and identity lifecycle (preview). If an access package has an appropriate policy, you can also directly assign identities to an access package. This article describes how to view, add, and remove assignments for access packages.