A partner requests access, gets invited automatically, and their account disappears when the project ends.
Entitlement management bundles groups, Teams, applications and SharePoint sites into access packages that people request, someone approves, and that expire on their own. For external identities it goes further: Microsoft states an approved requester who is not yet in your directory is automatically invited, and when access expires with no other assignments their B2B account can be automatically removed.
- Access packagesGroups, Teams, apps and sites bundled
- Time-limitedAssignments expire unless renewed
- Auto-inviteAnd automatic B2B account removal
- DelegatedCatalog owners create their own packages
Eight capabilities, and the external identity lifecycle is the one nothing else does.
External identities invited and removed automatically
Microsoft states that when an identity who is not yet in your directory requests access and is approved, they are automatically invited into your directory and assigned access, and that when their access expires, if they have no other access package assignments, their B2B account in your directory can be automatically removed. That closes the loop that leaves guest accounts sitting in tenants for years.
Access packages that bundle everything a role needs
A package can contain membership of Entra security groups, membership of Microsoft 365 Groups and Teams, assignment to enterprise applications including SaaS and custom-integrated applications supporting federation, single sign-on or provisioning, and membership of SharePoint Online sites. In preview it also covers API permissions for agent identities and SAP IAG business roles.
Time-limited by default rather than by exception
Microsoft describes ensuring identities do not retain access indefinitely through time-limited assignments and recurring access reviews. The policy attached to a package defines the duration of an assignment once approved, before it expires. This is the structural difference from a group: a group membership lasts until someone removes it, an assignment lasts until it expires.
Multi-stage approval, defined per policy
Each policy defines the approval process and the identities that can approve or deny access. Microsoft names multi-stage approval explicitly. A single package can carry two policies, one letting internal identities request access and a second letting identities from an external directory request the same package on different terms, which is how one bundle serves both audiences.
Catalogs, which is how you delegate without losing control
A catalog is a container of related resources and access packages, used for delegation so nonadministrators can create their own packages. Microsoft is precise about the boundary: an administrator can add resources to any catalog, but a nonadministrator can only add resources they own. Catalog owners can add co-owners or access package managers.
Automatic assignment based on identity properties
Microsoft describes giving identities access automatically based on properties like department or cost center, and removing access when those properties change. Assignment can also be direct by an administrator, or driven through lifecycle workflows. That covers the access that should follow a job rather than be requested, without forcing everything through a request form.
Indirect control over licences, Azure and Entra roles
Because a package can contain a security group, it can reach anything a group reaches. Microsoft names three: Microsoft 365 licences through group-based licensing, Azure resource management through an Azure role assignment on the group, and Microsoft Entra roles through groups assignable to Entra roles. That materially widens what a single package can grant.
Connected organizations, so partners are a defined set
A connected organization is an external Entra directory or domain you have a relationship with, and its identities can be named in a policy as allowed to request access. That turns partner access from a series of individual invitations, each made by whoever happened to need it, into a defined relationship that somebody owns.
Nobody in either organisation knows who should have access.
Microsoft states the problem plainly, and it matches what we find in every UAE group that works with contractors, suppliers or joint venture partners.
- Microsoft notes that identities might not know what access they, their direct reports, or the agents they sponsor should have, and even if they do, they could have difficulty locating the right individuals to approve it.
- It then notes that once access is discovered and assigned, identities could hold on to it longer than their business need requires. That is the standing access problem in one sentence.
- For external identities Microsoft says the problem is compounded: no one person might know all the specific individuals in another organisation directory to be able to invite them, and even if they could, no one in that organisation might remember to manage those identities access consistently.
- The answer is not better discipline. It is a package the partner requests, an approver who is named in the policy rather than found by asking around, and an expiry date that removes the access whether anyone remembers or not.
Four things that keep an entitlement model usable after year one.
We design catalogs before packages
Catalogs are the delegation boundary, and Microsoft is explicit that a nonadministrator can only add resources they own to a catalog. Getting that structure right first is what allows the business to run its own packages later. Building packages first and retrofitting catalogs around them is a rework exercise nobody enjoys.
We prove expiry before we build the second package
The entire value of the model is that access ends. We deliberately let an assignment expire and watch what happens, including the external account removal behaviour where the requester came from a connected organization and holds no other assignments. Until that is observed rather than assumed, the model is unverified.
We keep packages coarse enough that people use them
A package should map to something a human recognises: a project, a client engagement, a job function. Modelling every individual resource as its own package produces a catalogue nobody can navigate, and the request experience degrades to the point where people go back to raising tickets, which defeats the exercise.
We start with external access because that is where the pain is
Microsoft frames the external identity problem precisely, and it matches every UAE group working with contractors, suppliers and joint venture partners. Automatic invitation on approval and automatic B2B removal on expiry solve a problem that has no other good answer, which makes it the scenario that earns internal support for the rest.
Four phases, and phase one is deliberately narrow.
- 01Weeks 1 to 2
Catalogs and the first scenario
Confirm the licence position, since Microsoft states the feature requires Entra ID Governance or Entra Suite while some capabilities may operate with Entra ID P2. Then design the catalog structure, because catalogs are the delegation boundary and changing them later is disruptive. The first scenario is chosen for value, not for ease.
- Licence position confirmed against the tenant
- Catalog structure agreed with named owners
- Catalog creator list kept deliberately short
- First scenario chosen, usually partner or contractor access
- 02Weeks 3 to 4
The first package, end to end
One package containing the real resources the scenario needs, with a policy naming who can request, who approves, and how long the assignment lasts. Where the requesters are external, the connected organization is defined so that approval triggers the automatic invitation rather than a manual guest invite.
- Package built with real resources, not placeholders
- Approval chain named, including multi-stage where needed
- Assignment duration set deliberately
- Connected organization configured for external requesters
- 03Weeks 5 to 8
Prove the expiry, then widen
The step everyone skips. We deliberately let an assignment reach expiry and confirm that access is removed, and where the requester was external and holds no other assignments, that the B2B account removal behaves as configured. Only after that do we model further scenarios, because until expiry is proven the whole model is unverified.
- Expiry observed end to end, not assumed
- External account removal behaviour confirmed
- Renewal path tested from the user side
- Second and third scenarios modelled
- 04Ongoing
Delegate and review
Catalog ownership handed to the business areas that own the resources, access package managers appointed, and recurring access reviews attached to package assignments so recertification happens inside the same model rather than as a separate exercise. IT keeps the platform, the business keeps the decisions.
- Catalog owners and package managers trained
- Recurring reviews attached to assignments
- Automatic assignment rules where access should follow a job
- A named owner for the entitlement model itself
Six situations Microsoft names, and what they look like in the UAE.
Two organisations collaborating on a project
Microsoft lists this directly: multiple identities from one organisation need to be brought in through Entra B2B to access another organisation resources. A joint venture, a main contractor and subcontractor, or a client and advisory firm. The package defines what the partner gets, the connected organization defines who may ask, and the expiry defines when it ends.
Access that requires a manager or designated approver
Named in the published list as access that requires the approval of a person manager or other designated individuals. In regulated UAE firms this is frequently a control requirement rather than a preference, and multi-stage approval lets a line manager and a data owner both sign without either of them chasing the other by email.
Departments that want to manage their own access policies
Microsoft lists departments wishing to manage their own access policies for their resources without IT involvement. Catalogs and access package managers make that safe, because a nonadministrator can only add resources they already own. The department gets autonomy, IT keeps the platform, and nobody has to choose between the two.
Time-limited access for a particular task
The published example is instructive: use group-based licensing and a dynamic group to give all employees a mailbox, then use access packages for the extra rights, such as reading departmental resources from another department. That division, permanent access by rule and additional access by package, is the design that scales.
Access that should follow a job but also be requestable
Microsoft names access that should be assigned automatically to people in a particular part of an organisation during their time in that role, while remaining available for people elsewhere, or in a partner organisation, to request. Automatic assignment based on properties such as department or cost center covers the first half, the request policy covers the second.
Migrating from a third party role management product
Listed first among the appropriate scenarios: migrating access policy definitions from a third party enterprise role management system to Microsoft Entra ID. Organisations carrying an ageing identity governance product, often bought for a compliance programme years ago, get a route to consolidate onto what they already licence.
How UAE organisations grant project and partner access today.
| Feature | Entitlement management | Tickets and manual grants | Ad hoc, no process |
|---|---|---|---|
Access requested through a defined route | Yes | Yes | No |
Approver defined in advance | Yes | Sometimes | No |
Multi-stage approval available | Yes | Rarely | No |
Access expires without intervention | Yes | No | No |
External users invited automatically | Yes | No | No |
External accounts removed on expiry | Yes | No | No |
Business owns the decisions | Yes | No | No |
One request grants everything the role needs | Yes | Rarely | No |
Recertification built into the model | Yes | No | No |
IT effort per grant | None | High | Low but unmanaged |
Ten terms, because the documentation assumes you know them.
| Term | What Microsoft says it is | Why it matters | |
|---|---|---|---|
| Access package | A bundle of resources that a team or project needs, governed with policies, always contained in a catalog | The unit people request. Get the granularity wrong and you either have five packages or five hundred | |
| Access request | A request to access the resources in an access package, typically going through an approval workflow | If approved, the requester receives an assignment. This is the auditable event | |
| Assignment | Ensures the identity has all the resource roles of the package, typically with a time limit before expiry | The expiry is the whole point. An assignment without one is just a group membership | |
| Catalog | A container of related resources and access packages, used for delegation | Your delegation boundary. Design these before you design packages | |
| Catalog creator | Identities authorised to create new catalogs, who automatically own what they create | A small, deliberate list. This is a governance role, not an IT convenience | |
| Connected organization | An external Entra directory or domain you have a relationship with, whose identities can be allowed to request access | Turns ad hoc partner invitations into a managed relationship | |
| Policy | Rules defining how identities get access, who approves, and how long they have it | One package can carry several, which is how internal and external requesters differ | |
| Resource | An asset such as an Office group, security group, application or SharePoint site, with a role | What actually goes in the package | |
| Resource directory | A directory that has one or more resources to share | Relevant in multi-tenant estates, which UAE groups frequently are | |
| Resource role | A collection of permissions defined by the resource. A group has member and owner | Packages grant roles, not just membership. Owner is not the same as member |
Five steps, starting narrower than most people expect.
- 1
Confirm entitlement and choose the first scenario
Microsoft states the feature requires Entra ID Governance or Entra Suite subscriptions, with some capabilities possibly operating on Entra ID P2, so we check the tenant first. Then one scenario is chosen for value rather than ease, which in most UAE organisations means external partner or contractor access.
- 2
Design the catalog structure
Catalogs are containers of related resources and access packages, and they are the delegation boundary. We agree how many, who owns each, and who sits on the deliberately short catalog creator list. This is the decision that is expensive to change later, so it gets proper attention now.
- 3
Build one package end to end
Real resources rather than placeholders: security groups, Microsoft 365 Groups and Teams, enterprise applications and SharePoint sites as the scenario needs. Then the policy, defining who may request, the approval chain including multi-stage where appropriate, and the assignment duration before expiry.
- 4
Prove request, approval, expiry and removal
Including the external path where relevant: an approved requester who is not yet in the directory being automatically invited, and on expiry with no other assignments, the B2B account removal behaving as configured. We watch this happen rather than trusting the documentation, because the expiry half is the half that matters.
- 5
Widen, delegate and attach reviews
Further scenarios modelled, catalog ownership handed to the business areas that own the resources, access package managers appointed and trained, and recurring access reviews attached to assignments so recertification lives inside the same model rather than as a separate annual exercise.
What organisations ask about entitlement management.
Fifteen questions that decide the design.
Structure
- How many catalogs, and owned by whom?This is the delegation boundary.
- What granularity is a package?Per project, per role, or per resource.
- Which resources go in the first one?Groups, Teams, apps and SharePoint sites can mix.
- Do any packages need role-assignable groups?That is how Entra roles get in.
- Is group-based licensing in play?A package can grant licences indirectly.
Requesting and approving
- Who is eligible to request?Internal identities, or a connected organization.
- Single or multi-stage approval?Microsoft supports multi-stage.
- Who approves when the approver is away?Design it, do not discover it.
- Should some access be automatic instead?Based on department or cost centre.
- Is a justification required?It changes what an audit sees.
Ending access
- How long is an assignment?The policy sets it explicitly.
- What is the renewal experience?Test it from the user side.
- Should external accounts be removed on expiry?Only if no other assignments remain.
- Are reviews attached to assignments?Recertification inside the same model.
- Who notices if nothing ever expires?Somebody has to own the model.
The pages around this one.
Entra ID Governance
The suite entitlement management belongs to, and the licence it requires.
Entra access reviews
Recertification of package assignments and everything else Entra governs.
Privileged Identity Management
Just-in-time elevation for the administrative access packages should not hold permanently.
Pick the partner access problem you have never solved, and model it as one package.
Most organisations have one relationship where access was granted years ago and nobody can say who still holds it. That is the right first scenario, because it is the one where automatic invitation and automatic removal are worth the most.
Related Services
Explore more solutions that work great with this service
Entra External ID
Guests, partners and customer identity, governed
Entra ID Governance
Joiner mover leaver, access packages and guests that expire on their own
Entra Access Reviews
Recurring recertification of groups, apps and roles
Privileged Identity Management
Just-in-time admin access, approval, and audit history you can download
Entra Conditional Access
The control that decides who reaches your data
Entra ID P1 vs P2
What P2 genuinely adds, and what quietly moved
Microsoft Security Dubai
Entra, Defender, Purview, Sentinel, and what you already own
Access Rights Review
Certification that removes access, not one that gets approved